xref: /freebsd/sys/kern/vfs_syscalls.c (revision 730cecb05aaf016ac52ef7cfc691ccec3a0408cd)
1 /*-
2  * Copyright (c) 1989, 1993
3  *	The Regents of the University of California.  All rights reserved.
4  * (c) UNIX System Laboratories, Inc.
5  * All or some portions of this file are derived from material licensed
6  * to the University of California by American Telephone and Telegraph
7  * Co. or Unix System Laboratories, Inc. and are reproduced herein with
8  * the permission of UNIX System Laboratories, Inc.
9  *
10  * Redistribution and use in source and binary forms, with or without
11  * modification, are permitted provided that the following conditions
12  * are met:
13  * 1. Redistributions of source code must retain the above copyright
14  *    notice, this list of conditions and the following disclaimer.
15  * 2. Redistributions in binary form must reproduce the above copyright
16  *    notice, this list of conditions and the following disclaimer in the
17  *    documentation and/or other materials provided with the distribution.
18  * 4. Neither the name of the University nor the names of its contributors
19  *    may be used to endorse or promote products derived from this software
20  *    without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  *
34  *	@(#)vfs_syscalls.c	8.13 (Berkeley) 4/15/94
35  */
36 
37 #include <sys/cdefs.h>
38 __FBSDID("$FreeBSD$");
39 
40 #include "opt_capsicum.h"
41 #include "opt_compat.h"
42 #include "opt_kdtrace.h"
43 #include "opt_ktrace.h"
44 
45 #include <sys/param.h>
46 #include <sys/systm.h>
47 #include <sys/bio.h>
48 #include <sys/buf.h>
49 #include <sys/capability.h>
50 #include <sys/disk.h>
51 #include <sys/sysent.h>
52 #include <sys/malloc.h>
53 #include <sys/mount.h>
54 #include <sys/mutex.h>
55 #include <sys/sysproto.h>
56 #include <sys/namei.h>
57 #include <sys/filedesc.h>
58 #include <sys/kernel.h>
59 #include <sys/fcntl.h>
60 #include <sys/file.h>
61 #include <sys/filio.h>
62 #include <sys/limits.h>
63 #include <sys/linker.h>
64 #include <sys/rwlock.h>
65 #include <sys/sdt.h>
66 #include <sys/stat.h>
67 #include <sys/sx.h>
68 #include <sys/unistd.h>
69 #include <sys/vnode.h>
70 #include <sys/priv.h>
71 #include <sys/proc.h>
72 #include <sys/dirent.h>
73 #include <sys/jail.h>
74 #include <sys/syscallsubr.h>
75 #include <sys/sysctl.h>
76 #ifdef KTRACE
77 #include <sys/ktrace.h>
78 #endif
79 
80 #include <machine/stdarg.h>
81 
82 #include <security/audit/audit.h>
83 #include <security/mac/mac_framework.h>
84 
85 #include <vm/vm.h>
86 #include <vm/vm_object.h>
87 #include <vm/vm_page.h>
88 #include <vm/uma.h>
89 
90 #include <ufs/ufs/quota.h>
91 
92 MALLOC_DEFINE(M_FADVISE, "fadvise", "posix_fadvise(2) information");
93 
94 SDT_PROVIDER_DEFINE(vfs);
95 SDT_PROBE_DEFINE(vfs, , stat, mode, mode);
96 SDT_PROBE_ARGTYPE(vfs, , stat, mode, 0, "char *");
97 SDT_PROBE_ARGTYPE(vfs, , stat, mode, 1, "int");
98 SDT_PROBE_DEFINE(vfs, , stat, reg, reg);
99 SDT_PROBE_ARGTYPE(vfs, , stat, reg, 0, "char *");
100 SDT_PROBE_ARGTYPE(vfs, , stat, reg, 1, "int");
101 
102 static int chroot_refuse_vdir_fds(struct filedesc *fdp);
103 static int getutimes(const struct timeval *, enum uio_seg, struct timespec *);
104 static int kern_chflags(struct thread *td, const char *path,
105     enum uio_seg pathseg, u_long flags);
106 static int kern_chflagsat(struct thread *td, int fd, const char *path,
107     enum uio_seg pathseg, u_long flags, int atflag);
108 static int setfflags(struct thread *td, struct vnode *, u_long);
109 static int setutimes(struct thread *td, struct vnode *,
110     const struct timespec *, int, int);
111 static int vn_access(struct vnode *vp, int user_flags, struct ucred *cred,
112     struct thread *td);
113 
114 /*
115  * The module initialization routine for POSIX asynchronous I/O will
116  * set this to the version of AIO that it implements.  (Zero means
117  * that it is not implemented.)  This value is used here by pathconf()
118  * and in kern_descrip.c by fpathconf().
119  */
120 int async_io_version;
121 
122 #ifdef DEBUG
123 static int syncprt = 0;
124 SYSCTL_INT(_debug, OID_AUTO, syncprt, CTLFLAG_RW, &syncprt, 0, "");
125 #endif
126 
127 /*
128  * Sync each mounted filesystem.
129  */
130 #ifndef _SYS_SYSPROTO_H_
131 struct sync_args {
132 	int     dummy;
133 };
134 #endif
135 /* ARGSUSED */
136 int
137 sys_sync(td, uap)
138 	struct thread *td;
139 	struct sync_args *uap;
140 {
141 	struct mount *mp, *nmp;
142 	int save;
143 
144 	mtx_lock(&mountlist_mtx);
145 	for (mp = TAILQ_FIRST(&mountlist); mp != NULL; mp = nmp) {
146 		if (vfs_busy(mp, MBF_NOWAIT | MBF_MNTLSTLOCK)) {
147 			nmp = TAILQ_NEXT(mp, mnt_list);
148 			continue;
149 		}
150 		if ((mp->mnt_flag & MNT_RDONLY) == 0 &&
151 		    vn_start_write(NULL, &mp, V_NOWAIT) == 0) {
152 			save = curthread_pflags_set(TDP_SYNCIO);
153 			vfs_msync(mp, MNT_NOWAIT);
154 			VFS_SYNC(mp, MNT_NOWAIT);
155 			curthread_pflags_restore(save);
156 			vn_finished_write(mp);
157 		}
158 		mtx_lock(&mountlist_mtx);
159 		nmp = TAILQ_NEXT(mp, mnt_list);
160 		vfs_unbusy(mp);
161 	}
162 	mtx_unlock(&mountlist_mtx);
163 	return (0);
164 }
165 
166 /*
167  * Change filesystem quotas.
168  */
169 #ifndef _SYS_SYSPROTO_H_
170 struct quotactl_args {
171 	char *path;
172 	int cmd;
173 	int uid;
174 	caddr_t arg;
175 };
176 #endif
177 int
178 sys_quotactl(td, uap)
179 	struct thread *td;
180 	register struct quotactl_args /* {
181 		char *path;
182 		int cmd;
183 		int uid;
184 		caddr_t arg;
185 	} */ *uap;
186 {
187 	struct mount *mp;
188 	int error;
189 	struct nameidata nd;
190 
191 	AUDIT_ARG_CMD(uap->cmd);
192 	AUDIT_ARG_UID(uap->uid);
193 	if (!prison_allow(td->td_ucred, PR_ALLOW_QUOTAS))
194 		return (EPERM);
195 	NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | AUDITVNODE1, UIO_USERSPACE,
196 	    uap->path, td);
197 	if ((error = namei(&nd)) != 0)
198 		return (error);
199 	NDFREE(&nd, NDF_ONLY_PNBUF);
200 	mp = nd.ni_vp->v_mount;
201 	vfs_ref(mp);
202 	vput(nd.ni_vp);
203 	error = vfs_busy(mp, 0);
204 	vfs_rel(mp);
205 	if (error)
206 		return (error);
207 	error = VFS_QUOTACTL(mp, uap->cmd, uap->uid, uap->arg);
208 
209 	/*
210 	 * Since quota on operation typically needs to open quota
211 	 * file, the Q_QUOTAON handler needs to unbusy the mount point
212 	 * before calling into namei.  Otherwise, unmount might be
213 	 * started between two vfs_busy() invocations (first is our,
214 	 * second is from mount point cross-walk code in lookup()),
215 	 * causing deadlock.
216 	 *
217 	 * Require that Q_QUOTAON handles the vfs_busy() reference on
218 	 * its own, always returning with ubusied mount point.
219 	 */
220 	if ((uap->cmd >> SUBCMDSHIFT) != Q_QUOTAON)
221 		vfs_unbusy(mp);
222 	return (error);
223 }
224 
225 /*
226  * Used by statfs conversion routines to scale the block size up if
227  * necessary so that all of the block counts are <= 'max_size'.  Note
228  * that 'max_size' should be a bitmask, i.e. 2^n - 1 for some non-zero
229  * value of 'n'.
230  */
231 void
232 statfs_scale_blocks(struct statfs *sf, long max_size)
233 {
234 	uint64_t count;
235 	int shift;
236 
237 	KASSERT(powerof2(max_size + 1), ("%s: invalid max_size", __func__));
238 
239 	/*
240 	 * Attempt to scale the block counts to give a more accurate
241 	 * overview to userland of the ratio of free space to used
242 	 * space.  To do this, find the largest block count and compute
243 	 * a divisor that lets it fit into a signed integer <= max_size.
244 	 */
245 	if (sf->f_bavail < 0)
246 		count = -sf->f_bavail;
247 	else
248 		count = sf->f_bavail;
249 	count = MAX(sf->f_blocks, MAX(sf->f_bfree, count));
250 	if (count <= max_size)
251 		return;
252 
253 	count >>= flsl(max_size);
254 	shift = 0;
255 	while (count > 0) {
256 		shift++;
257 		count >>=1;
258 	}
259 
260 	sf->f_bsize <<= shift;
261 	sf->f_blocks >>= shift;
262 	sf->f_bfree >>= shift;
263 	sf->f_bavail >>= shift;
264 }
265 
266 /*
267  * Get filesystem statistics.
268  */
269 #ifndef _SYS_SYSPROTO_H_
270 struct statfs_args {
271 	char *path;
272 	struct statfs *buf;
273 };
274 #endif
275 int
276 sys_statfs(td, uap)
277 	struct thread *td;
278 	register struct statfs_args /* {
279 		char *path;
280 		struct statfs *buf;
281 	} */ *uap;
282 {
283 	struct statfs sf;
284 	int error;
285 
286 	error = kern_statfs(td, uap->path, UIO_USERSPACE, &sf);
287 	if (error == 0)
288 		error = copyout(&sf, uap->buf, sizeof(sf));
289 	return (error);
290 }
291 
292 int
293 kern_statfs(struct thread *td, char *path, enum uio_seg pathseg,
294     struct statfs *buf)
295 {
296 	struct mount *mp;
297 	struct statfs *sp, sb;
298 	int error;
299 	struct nameidata nd;
300 
301 	NDINIT(&nd, LOOKUP, FOLLOW | LOCKSHARED | LOCKLEAF | AUDITVNODE1,
302 	    pathseg, path, td);
303 	error = namei(&nd);
304 	if (error)
305 		return (error);
306 	mp = nd.ni_vp->v_mount;
307 	vfs_ref(mp);
308 	NDFREE(&nd, NDF_ONLY_PNBUF);
309 	vput(nd.ni_vp);
310 	error = vfs_busy(mp, 0);
311 	vfs_rel(mp);
312 	if (error)
313 		return (error);
314 #ifdef MAC
315 	error = mac_mount_check_stat(td->td_ucred, mp);
316 	if (error)
317 		goto out;
318 #endif
319 	/*
320 	 * Set these in case the underlying filesystem fails to do so.
321 	 */
322 	sp = &mp->mnt_stat;
323 	sp->f_version = STATFS_VERSION;
324 	sp->f_namemax = NAME_MAX;
325 	sp->f_flags = mp->mnt_flag & MNT_VISFLAGMASK;
326 	error = VFS_STATFS(mp, sp);
327 	if (error)
328 		goto out;
329 	if (priv_check(td, PRIV_VFS_GENERATION)) {
330 		bcopy(sp, &sb, sizeof(sb));
331 		sb.f_fsid.val[0] = sb.f_fsid.val[1] = 0;
332 		prison_enforce_statfs(td->td_ucred, mp, &sb);
333 		sp = &sb;
334 	}
335 	*buf = *sp;
336 out:
337 	vfs_unbusy(mp);
338 	return (error);
339 }
340 
341 /*
342  * Get filesystem statistics.
343  */
344 #ifndef _SYS_SYSPROTO_H_
345 struct fstatfs_args {
346 	int fd;
347 	struct statfs *buf;
348 };
349 #endif
350 int
351 sys_fstatfs(td, uap)
352 	struct thread *td;
353 	register struct fstatfs_args /* {
354 		int fd;
355 		struct statfs *buf;
356 	} */ *uap;
357 {
358 	struct statfs sf;
359 	int error;
360 
361 	error = kern_fstatfs(td, uap->fd, &sf);
362 	if (error == 0)
363 		error = copyout(&sf, uap->buf, sizeof(sf));
364 	return (error);
365 }
366 
367 int
368 kern_fstatfs(struct thread *td, int fd, struct statfs *buf)
369 {
370 	struct file *fp;
371 	struct mount *mp;
372 	struct statfs *sp, sb;
373 	struct vnode *vp;
374 	int error;
375 
376 	AUDIT_ARG_FD(fd);
377 	error = getvnode(td->td_proc->p_fd, fd, CAP_FSTATFS, &fp);
378 	if (error)
379 		return (error);
380 	vp = fp->f_vnode;
381 	vn_lock(vp, LK_SHARED | LK_RETRY);
382 #ifdef AUDIT
383 	AUDIT_ARG_VNODE1(vp);
384 #endif
385 	mp = vp->v_mount;
386 	if (mp)
387 		vfs_ref(mp);
388 	VOP_UNLOCK(vp, 0);
389 	fdrop(fp, td);
390 	if (mp == NULL) {
391 		error = EBADF;
392 		goto out;
393 	}
394 	error = vfs_busy(mp, 0);
395 	vfs_rel(mp);
396 	if (error)
397 		return (error);
398 #ifdef MAC
399 	error = mac_mount_check_stat(td->td_ucred, mp);
400 	if (error)
401 		goto out;
402 #endif
403 	/*
404 	 * Set these in case the underlying filesystem fails to do so.
405 	 */
406 	sp = &mp->mnt_stat;
407 	sp->f_version = STATFS_VERSION;
408 	sp->f_namemax = NAME_MAX;
409 	sp->f_flags = mp->mnt_flag & MNT_VISFLAGMASK;
410 	error = VFS_STATFS(mp, sp);
411 	if (error)
412 		goto out;
413 	if (priv_check(td, PRIV_VFS_GENERATION)) {
414 		bcopy(sp, &sb, sizeof(sb));
415 		sb.f_fsid.val[0] = sb.f_fsid.val[1] = 0;
416 		prison_enforce_statfs(td->td_ucred, mp, &sb);
417 		sp = &sb;
418 	}
419 	*buf = *sp;
420 out:
421 	if (mp)
422 		vfs_unbusy(mp);
423 	return (error);
424 }
425 
426 /*
427  * Get statistics on all filesystems.
428  */
429 #ifndef _SYS_SYSPROTO_H_
430 struct getfsstat_args {
431 	struct statfs *buf;
432 	long bufsize;
433 	int flags;
434 };
435 #endif
436 int
437 sys_getfsstat(td, uap)
438 	struct thread *td;
439 	register struct getfsstat_args /* {
440 		struct statfs *buf;
441 		long bufsize;
442 		int flags;
443 	} */ *uap;
444 {
445 
446 	return (kern_getfsstat(td, &uap->buf, uap->bufsize, UIO_USERSPACE,
447 	    uap->flags));
448 }
449 
450 /*
451  * If (bufsize > 0 && bufseg == UIO_SYSSPACE)
452  *	The caller is responsible for freeing memory which will be allocated
453  *	in '*buf'.
454  */
455 int
456 kern_getfsstat(struct thread *td, struct statfs **buf, size_t bufsize,
457     enum uio_seg bufseg, int flags)
458 {
459 	struct mount *mp, *nmp;
460 	struct statfs *sfsp, *sp, sb;
461 	size_t count, maxcount;
462 	int error;
463 
464 	maxcount = bufsize / sizeof(struct statfs);
465 	if (bufsize == 0)
466 		sfsp = NULL;
467 	else if (bufseg == UIO_USERSPACE)
468 		sfsp = *buf;
469 	else /* if (bufseg == UIO_SYSSPACE) */ {
470 		count = 0;
471 		mtx_lock(&mountlist_mtx);
472 		TAILQ_FOREACH(mp, &mountlist, mnt_list) {
473 			count++;
474 		}
475 		mtx_unlock(&mountlist_mtx);
476 		if (maxcount > count)
477 			maxcount = count;
478 		sfsp = *buf = malloc(maxcount * sizeof(struct statfs), M_TEMP,
479 		    M_WAITOK);
480 	}
481 	count = 0;
482 	mtx_lock(&mountlist_mtx);
483 	for (mp = TAILQ_FIRST(&mountlist); mp != NULL; mp = nmp) {
484 		if (prison_canseemount(td->td_ucred, mp) != 0) {
485 			nmp = TAILQ_NEXT(mp, mnt_list);
486 			continue;
487 		}
488 #ifdef MAC
489 		if (mac_mount_check_stat(td->td_ucred, mp) != 0) {
490 			nmp = TAILQ_NEXT(mp, mnt_list);
491 			continue;
492 		}
493 #endif
494 		if (vfs_busy(mp, MBF_NOWAIT | MBF_MNTLSTLOCK)) {
495 			nmp = TAILQ_NEXT(mp, mnt_list);
496 			continue;
497 		}
498 		if (sfsp && count < maxcount) {
499 			sp = &mp->mnt_stat;
500 			/*
501 			 * Set these in case the underlying filesystem
502 			 * fails to do so.
503 			 */
504 			sp->f_version = STATFS_VERSION;
505 			sp->f_namemax = NAME_MAX;
506 			sp->f_flags = mp->mnt_flag & MNT_VISFLAGMASK;
507 			/*
508 			 * If MNT_NOWAIT or MNT_LAZY is specified, do not
509 			 * refresh the fsstat cache. MNT_NOWAIT or MNT_LAZY
510 			 * overrides MNT_WAIT.
511 			 */
512 			if (((flags & (MNT_LAZY|MNT_NOWAIT)) == 0 ||
513 			    (flags & MNT_WAIT)) &&
514 			    (error = VFS_STATFS(mp, sp))) {
515 				mtx_lock(&mountlist_mtx);
516 				nmp = TAILQ_NEXT(mp, mnt_list);
517 				vfs_unbusy(mp);
518 				continue;
519 			}
520 			if (priv_check(td, PRIV_VFS_GENERATION)) {
521 				bcopy(sp, &sb, sizeof(sb));
522 				sb.f_fsid.val[0] = sb.f_fsid.val[1] = 0;
523 				prison_enforce_statfs(td->td_ucred, mp, &sb);
524 				sp = &sb;
525 			}
526 			if (bufseg == UIO_SYSSPACE)
527 				bcopy(sp, sfsp, sizeof(*sp));
528 			else /* if (bufseg == UIO_USERSPACE) */ {
529 				error = copyout(sp, sfsp, sizeof(*sp));
530 				if (error) {
531 					vfs_unbusy(mp);
532 					return (error);
533 				}
534 			}
535 			sfsp++;
536 		}
537 		count++;
538 		mtx_lock(&mountlist_mtx);
539 		nmp = TAILQ_NEXT(mp, mnt_list);
540 		vfs_unbusy(mp);
541 	}
542 	mtx_unlock(&mountlist_mtx);
543 	if (sfsp && count > maxcount)
544 		td->td_retval[0] = maxcount;
545 	else
546 		td->td_retval[0] = count;
547 	return (0);
548 }
549 
550 #ifdef COMPAT_FREEBSD4
551 /*
552  * Get old format filesystem statistics.
553  */
554 static void cvtstatfs(struct statfs *, struct ostatfs *);
555 
556 #ifndef _SYS_SYSPROTO_H_
557 struct freebsd4_statfs_args {
558 	char *path;
559 	struct ostatfs *buf;
560 };
561 #endif
562 int
563 freebsd4_statfs(td, uap)
564 	struct thread *td;
565 	struct freebsd4_statfs_args /* {
566 		char *path;
567 		struct ostatfs *buf;
568 	} */ *uap;
569 {
570 	struct ostatfs osb;
571 	struct statfs sf;
572 	int error;
573 
574 	error = kern_statfs(td, uap->path, UIO_USERSPACE, &sf);
575 	if (error)
576 		return (error);
577 	cvtstatfs(&sf, &osb);
578 	return (copyout(&osb, uap->buf, sizeof(osb)));
579 }
580 
581 /*
582  * Get filesystem statistics.
583  */
584 #ifndef _SYS_SYSPROTO_H_
585 struct freebsd4_fstatfs_args {
586 	int fd;
587 	struct ostatfs *buf;
588 };
589 #endif
590 int
591 freebsd4_fstatfs(td, uap)
592 	struct thread *td;
593 	struct freebsd4_fstatfs_args /* {
594 		int fd;
595 		struct ostatfs *buf;
596 	} */ *uap;
597 {
598 	struct ostatfs osb;
599 	struct statfs sf;
600 	int error;
601 
602 	error = kern_fstatfs(td, uap->fd, &sf);
603 	if (error)
604 		return (error);
605 	cvtstatfs(&sf, &osb);
606 	return (copyout(&osb, uap->buf, sizeof(osb)));
607 }
608 
609 /*
610  * Get statistics on all filesystems.
611  */
612 #ifndef _SYS_SYSPROTO_H_
613 struct freebsd4_getfsstat_args {
614 	struct ostatfs *buf;
615 	long bufsize;
616 	int flags;
617 };
618 #endif
619 int
620 freebsd4_getfsstat(td, uap)
621 	struct thread *td;
622 	register struct freebsd4_getfsstat_args /* {
623 		struct ostatfs *buf;
624 		long bufsize;
625 		int flags;
626 	} */ *uap;
627 {
628 	struct statfs *buf, *sp;
629 	struct ostatfs osb;
630 	size_t count, size;
631 	int error;
632 
633 	count = uap->bufsize / sizeof(struct ostatfs);
634 	size = count * sizeof(struct statfs);
635 	error = kern_getfsstat(td, &buf, size, UIO_SYSSPACE, uap->flags);
636 	if (size > 0) {
637 		count = td->td_retval[0];
638 		sp = buf;
639 		while (count > 0 && error == 0) {
640 			cvtstatfs(sp, &osb);
641 			error = copyout(&osb, uap->buf, sizeof(osb));
642 			sp++;
643 			uap->buf++;
644 			count--;
645 		}
646 		free(buf, M_TEMP);
647 	}
648 	return (error);
649 }
650 
651 /*
652  * Implement fstatfs() for (NFS) file handles.
653  */
654 #ifndef _SYS_SYSPROTO_H_
655 struct freebsd4_fhstatfs_args {
656 	struct fhandle *u_fhp;
657 	struct ostatfs *buf;
658 };
659 #endif
660 int
661 freebsd4_fhstatfs(td, uap)
662 	struct thread *td;
663 	struct freebsd4_fhstatfs_args /* {
664 		struct fhandle *u_fhp;
665 		struct ostatfs *buf;
666 	} */ *uap;
667 {
668 	struct ostatfs osb;
669 	struct statfs sf;
670 	fhandle_t fh;
671 	int error;
672 
673 	error = copyin(uap->u_fhp, &fh, sizeof(fhandle_t));
674 	if (error)
675 		return (error);
676 	error = kern_fhstatfs(td, fh, &sf);
677 	if (error)
678 		return (error);
679 	cvtstatfs(&sf, &osb);
680 	return (copyout(&osb, uap->buf, sizeof(osb)));
681 }
682 
683 /*
684  * Convert a new format statfs structure to an old format statfs structure.
685  */
686 static void
687 cvtstatfs(nsp, osp)
688 	struct statfs *nsp;
689 	struct ostatfs *osp;
690 {
691 
692 	statfs_scale_blocks(nsp, LONG_MAX);
693 	bzero(osp, sizeof(*osp));
694 	osp->f_bsize = nsp->f_bsize;
695 	osp->f_iosize = MIN(nsp->f_iosize, LONG_MAX);
696 	osp->f_blocks = nsp->f_blocks;
697 	osp->f_bfree = nsp->f_bfree;
698 	osp->f_bavail = nsp->f_bavail;
699 	osp->f_files = MIN(nsp->f_files, LONG_MAX);
700 	osp->f_ffree = MIN(nsp->f_ffree, LONG_MAX);
701 	osp->f_owner = nsp->f_owner;
702 	osp->f_type = nsp->f_type;
703 	osp->f_flags = nsp->f_flags;
704 	osp->f_syncwrites = MIN(nsp->f_syncwrites, LONG_MAX);
705 	osp->f_asyncwrites = MIN(nsp->f_asyncwrites, LONG_MAX);
706 	osp->f_syncreads = MIN(nsp->f_syncreads, LONG_MAX);
707 	osp->f_asyncreads = MIN(nsp->f_asyncreads, LONG_MAX);
708 	strlcpy(osp->f_fstypename, nsp->f_fstypename,
709 	    MIN(MFSNAMELEN, OMFSNAMELEN));
710 	strlcpy(osp->f_mntonname, nsp->f_mntonname,
711 	    MIN(MNAMELEN, OMNAMELEN));
712 	strlcpy(osp->f_mntfromname, nsp->f_mntfromname,
713 	    MIN(MNAMELEN, OMNAMELEN));
714 	osp->f_fsid = nsp->f_fsid;
715 }
716 #endif /* COMPAT_FREEBSD4 */
717 
718 /*
719  * Change current working directory to a given file descriptor.
720  */
721 #ifndef _SYS_SYSPROTO_H_
722 struct fchdir_args {
723 	int	fd;
724 };
725 #endif
726 int
727 sys_fchdir(td, uap)
728 	struct thread *td;
729 	struct fchdir_args /* {
730 		int fd;
731 	} */ *uap;
732 {
733 	register struct filedesc *fdp = td->td_proc->p_fd;
734 	struct vnode *vp, *tdp, *vpold;
735 	struct mount *mp;
736 	struct file *fp;
737 	int error;
738 
739 	AUDIT_ARG_FD(uap->fd);
740 	if ((error = getvnode(fdp, uap->fd, CAP_FCHDIR, &fp)) != 0)
741 		return (error);
742 	vp = fp->f_vnode;
743 	VREF(vp);
744 	fdrop(fp, td);
745 	vn_lock(vp, LK_SHARED | LK_RETRY);
746 	AUDIT_ARG_VNODE1(vp);
747 	error = change_dir(vp, td);
748 	while (!error && (mp = vp->v_mountedhere) != NULL) {
749 		if (vfs_busy(mp, 0))
750 			continue;
751 		error = VFS_ROOT(mp, LK_SHARED, &tdp);
752 		vfs_unbusy(mp);
753 		if (error)
754 			break;
755 		vput(vp);
756 		vp = tdp;
757 	}
758 	if (error) {
759 		vput(vp);
760 		return (error);
761 	}
762 	VOP_UNLOCK(vp, 0);
763 	FILEDESC_XLOCK(fdp);
764 	vpold = fdp->fd_cdir;
765 	fdp->fd_cdir = vp;
766 	FILEDESC_XUNLOCK(fdp);
767 	vrele(vpold);
768 	return (0);
769 }
770 
771 /*
772  * Change current working directory (``.'').
773  */
774 #ifndef _SYS_SYSPROTO_H_
775 struct chdir_args {
776 	char	*path;
777 };
778 #endif
779 int
780 sys_chdir(td, uap)
781 	struct thread *td;
782 	struct chdir_args /* {
783 		char *path;
784 	} */ *uap;
785 {
786 
787 	return (kern_chdir(td, uap->path, UIO_USERSPACE));
788 }
789 
790 int
791 kern_chdir(struct thread *td, char *path, enum uio_seg pathseg)
792 {
793 	register struct filedesc *fdp = td->td_proc->p_fd;
794 	int error;
795 	struct nameidata nd;
796 	struct vnode *vp;
797 
798 	NDINIT(&nd, LOOKUP, FOLLOW | LOCKSHARED | LOCKLEAF | AUDITVNODE1,
799 	    pathseg, path, td);
800 	if ((error = namei(&nd)) != 0)
801 		return (error);
802 	if ((error = change_dir(nd.ni_vp, td)) != 0) {
803 		vput(nd.ni_vp);
804 		NDFREE(&nd, NDF_ONLY_PNBUF);
805 		return (error);
806 	}
807 	VOP_UNLOCK(nd.ni_vp, 0);
808 	NDFREE(&nd, NDF_ONLY_PNBUF);
809 	FILEDESC_XLOCK(fdp);
810 	vp = fdp->fd_cdir;
811 	fdp->fd_cdir = nd.ni_vp;
812 	FILEDESC_XUNLOCK(fdp);
813 	vrele(vp);
814 	return (0);
815 }
816 
817 /*
818  * Helper function for raised chroot(2) security function:  Refuse if
819  * any filedescriptors are open directories.
820  */
821 static int
822 chroot_refuse_vdir_fds(fdp)
823 	struct filedesc *fdp;
824 {
825 	struct vnode *vp;
826 	struct file *fp;
827 	int fd;
828 
829 	FILEDESC_LOCK_ASSERT(fdp);
830 
831 	for (fd = 0; fd < fdp->fd_nfiles ; fd++) {
832 		fp = fget_locked(fdp, fd);
833 		if (fp == NULL)
834 			continue;
835 		if (fp->f_type == DTYPE_VNODE) {
836 			vp = fp->f_vnode;
837 			if (vp->v_type == VDIR)
838 				return (EPERM);
839 		}
840 	}
841 	return (0);
842 }
843 
844 /*
845  * This sysctl determines if we will allow a process to chroot(2) if it
846  * has a directory open:
847  *	0: disallowed for all processes.
848  *	1: allowed for processes that were not already chroot(2)'ed.
849  *	2: allowed for all processes.
850  */
851 
852 static int chroot_allow_open_directories = 1;
853 
854 SYSCTL_INT(_kern, OID_AUTO, chroot_allow_open_directories, CTLFLAG_RW,
855      &chroot_allow_open_directories, 0,
856      "Allow a process to chroot(2) if it has a directory open");
857 
858 /*
859  * Change notion of root (``/'') directory.
860  */
861 #ifndef _SYS_SYSPROTO_H_
862 struct chroot_args {
863 	char	*path;
864 };
865 #endif
866 int
867 sys_chroot(td, uap)
868 	struct thread *td;
869 	struct chroot_args /* {
870 		char *path;
871 	} */ *uap;
872 {
873 	int error;
874 	struct nameidata nd;
875 
876 	error = priv_check(td, PRIV_VFS_CHROOT);
877 	if (error)
878 		return (error);
879 	NDINIT(&nd, LOOKUP, FOLLOW | LOCKSHARED | LOCKLEAF | AUDITVNODE1,
880 	    UIO_USERSPACE, uap->path, td);
881 	error = namei(&nd);
882 	if (error)
883 		goto error;
884 	if ((error = change_dir(nd.ni_vp, td)) != 0)
885 		goto e_vunlock;
886 #ifdef MAC
887 	if ((error = mac_vnode_check_chroot(td->td_ucred, nd.ni_vp)))
888 		goto e_vunlock;
889 #endif
890 	VOP_UNLOCK(nd.ni_vp, 0);
891 	error = change_root(nd.ni_vp, td);
892 	vrele(nd.ni_vp);
893 	NDFREE(&nd, NDF_ONLY_PNBUF);
894 	return (error);
895 e_vunlock:
896 	vput(nd.ni_vp);
897 error:
898 	NDFREE(&nd, NDF_ONLY_PNBUF);
899 	return (error);
900 }
901 
902 /*
903  * Common routine for chroot and chdir.  Callers must provide a locked vnode
904  * instance.
905  */
906 int
907 change_dir(vp, td)
908 	struct vnode *vp;
909 	struct thread *td;
910 {
911 	int error;
912 
913 	ASSERT_VOP_LOCKED(vp, "change_dir(): vp not locked");
914 	if (vp->v_type != VDIR)
915 		return (ENOTDIR);
916 #ifdef MAC
917 	error = mac_vnode_check_chdir(td->td_ucred, vp);
918 	if (error)
919 		return (error);
920 #endif
921 	error = VOP_ACCESS(vp, VEXEC, td->td_ucred, td);
922 	return (error);
923 }
924 
925 /*
926  * Common routine for kern_chroot() and jail_attach().  The caller is
927  * responsible for invoking priv_check() and mac_vnode_check_chroot() to
928  * authorize this operation.
929  */
930 int
931 change_root(vp, td)
932 	struct vnode *vp;
933 	struct thread *td;
934 {
935 	struct filedesc *fdp;
936 	struct vnode *oldvp;
937 	int error;
938 
939 	fdp = td->td_proc->p_fd;
940 	FILEDESC_XLOCK(fdp);
941 	if (chroot_allow_open_directories == 0 ||
942 	    (chroot_allow_open_directories == 1 && fdp->fd_rdir != rootvnode)) {
943 		error = chroot_refuse_vdir_fds(fdp);
944 		if (error) {
945 			FILEDESC_XUNLOCK(fdp);
946 			return (error);
947 		}
948 	}
949 	oldvp = fdp->fd_rdir;
950 	fdp->fd_rdir = vp;
951 	VREF(fdp->fd_rdir);
952 	if (!fdp->fd_jdir) {
953 		fdp->fd_jdir = vp;
954 		VREF(fdp->fd_jdir);
955 	}
956 	FILEDESC_XUNLOCK(fdp);
957 	vrele(oldvp);
958 	return (0);
959 }
960 
961 static __inline cap_rights_t
962 flags_to_rights(int flags)
963 {
964 	cap_rights_t rights = 0;
965 
966 	if (flags & O_EXEC) {
967 		rights |= CAP_FEXECVE;
968 	} else {
969 		switch ((flags & O_ACCMODE)) {
970 		case O_RDONLY:
971 			rights |= CAP_READ;
972 			break;
973 		case O_RDWR:
974 			rights |= CAP_READ;
975 			/* FALLTHROUGH */
976 		case O_WRONLY:
977 			rights |= CAP_WRITE;
978 			if (!(flags & (O_APPEND | O_TRUNC)))
979 				rights |= CAP_SEEK;
980 			break;
981 		}
982 	}
983 
984 	if (flags & O_CREAT)
985 		rights |= CAP_CREATE;
986 
987 	if (flags & O_TRUNC)
988 		rights |= CAP_FTRUNCATE;
989 
990 	if (flags & (O_SYNC | O_FSYNC))
991 		rights |= CAP_FSYNC;
992 
993 	if (flags & (O_EXLOCK | O_SHLOCK))
994 		rights |= CAP_FLOCK;
995 
996 	return (rights);
997 }
998 
999 /*
1000  * Check permissions, allocate an open file structure, and call the device
1001  * open routine if any.
1002  */
1003 #ifndef _SYS_SYSPROTO_H_
1004 struct open_args {
1005 	char	*path;
1006 	int	flags;
1007 	int	mode;
1008 };
1009 #endif
1010 int
1011 sys_open(td, uap)
1012 	struct thread *td;
1013 	register struct open_args /* {
1014 		char *path;
1015 		int flags;
1016 		int mode;
1017 	} */ *uap;
1018 {
1019 
1020 	return (kern_open(td, uap->path, UIO_USERSPACE, uap->flags, uap->mode));
1021 }
1022 
1023 #ifndef _SYS_SYSPROTO_H_
1024 struct openat_args {
1025 	int	fd;
1026 	char	*path;
1027 	int	flag;
1028 	int	mode;
1029 };
1030 #endif
1031 int
1032 sys_openat(struct thread *td, struct openat_args *uap)
1033 {
1034 
1035 	return (kern_openat(td, uap->fd, uap->path, UIO_USERSPACE, uap->flag,
1036 	    uap->mode));
1037 }
1038 
1039 int
1040 kern_open(struct thread *td, char *path, enum uio_seg pathseg, int flags,
1041     int mode)
1042 {
1043 
1044 	return (kern_openat(td, AT_FDCWD, path, pathseg, flags, mode));
1045 }
1046 
1047 int
1048 kern_openat(struct thread *td, int fd, char *path, enum uio_seg pathseg,
1049     int flags, int mode)
1050 {
1051 	struct proc *p = td->td_proc;
1052 	struct filedesc *fdp = p->p_fd;
1053 	struct file *fp;
1054 	struct vnode *vp;
1055 	int cmode;
1056 	int indx = -1, error;
1057 	struct nameidata nd;
1058 	cap_rights_t rights_needed = CAP_LOOKUP;
1059 
1060 	AUDIT_ARG_FFLAGS(flags);
1061 	AUDIT_ARG_MODE(mode);
1062 	/* XXX: audit dirfd */
1063 	rights_needed |= flags_to_rights(flags);
1064 	/*
1065 	 * Only one of the O_EXEC, O_RDONLY, O_WRONLY and O_RDWR flags
1066 	 * may be specified.
1067 	 */
1068 	if (flags & O_EXEC) {
1069 		if (flags & O_ACCMODE)
1070 			return (EINVAL);
1071 	} else if ((flags & O_ACCMODE) == O_ACCMODE) {
1072 		return (EINVAL);
1073 	} else {
1074 		flags = FFLAGS(flags);
1075 	}
1076 
1077 	/*
1078 	 * Allocate the file descriptor, but don't install a descriptor yet.
1079 	 */
1080 	error = falloc_noinstall(td, &fp);
1081 	if (error)
1082 		return (error);
1083 	/*
1084 	 * An extra reference on `fp' has been held for us by
1085 	 * falloc_noinstall().
1086 	 */
1087 	/* Set the flags early so the finit in devfs can pick them up. */
1088 	fp->f_flag = flags & FMASK;
1089 	cmode = ((mode &~ fdp->fd_cmask) & ALLPERMS) &~ S_ISTXT;
1090 	NDINIT_ATRIGHTS(&nd, LOOKUP, FOLLOW | AUDITVNODE1, pathseg, path, fd,
1091 	    rights_needed, td);
1092 	td->td_dupfd = -1;		/* XXX check for fdopen */
1093 	error = vn_open(&nd, &flags, cmode, fp);
1094 	if (error) {
1095 		/*
1096 		 * If the vn_open replaced the method vector, something
1097 		 * wonderous happened deep below and we just pass it up
1098 		 * pretending we know what we do.
1099 		 */
1100 		if (error == ENXIO && fp->f_ops != &badfileops)
1101 			goto success;
1102 
1103 		/*
1104 		 * Handle special fdopen() case. bleh.
1105 		 *
1106 		 * Don't do this for relative (capability) lookups; we don't
1107 		 * understand exactly what would happen, and we don't think
1108 		 * that it ever should.
1109 		 */
1110 		if (nd.ni_strictrelative == 0 &&
1111 		    (error == ENODEV || error == ENXIO) &&
1112 		    td->td_dupfd >= 0) {
1113 			error = dupfdopen(td, fdp, td->td_dupfd, flags, error,
1114 			    &indx);
1115 			if (error == 0)
1116 				goto success;
1117 		}
1118 
1119 		goto bad;
1120 	}
1121 	td->td_dupfd = 0;
1122 	NDFREE(&nd, NDF_ONLY_PNBUF);
1123 	vp = nd.ni_vp;
1124 
1125 	/*
1126 	 * Store the vnode, for any f_type. Typically, the vnode use
1127 	 * count is decremented by direct call to vn_closefile() for
1128 	 * files that switched type in the cdevsw fdopen() method.
1129 	 */
1130 	fp->f_vnode = vp;
1131 	/*
1132 	 * If the file wasn't claimed by devfs bind it to the normal
1133 	 * vnode operations here.
1134 	 */
1135 	if (fp->f_ops == &badfileops) {
1136 		KASSERT(vp->v_type != VFIFO, ("Unexpected fifo."));
1137 		fp->f_seqcount = 1;
1138 		finit(fp, (flags & FMASK) | (fp->f_flag & FHASLOCK), DTYPE_VNODE,
1139 		    vp, &vnops);
1140 	}
1141 
1142 	VOP_UNLOCK(vp, 0);
1143 	if (flags & O_TRUNC) {
1144 		error = fo_truncate(fp, 0, td->td_ucred, td);
1145 		if (error)
1146 			goto bad;
1147 	}
1148 success:
1149 	/*
1150 	 * If we haven't already installed the FD (for dupfdopen), do so now.
1151 	 */
1152 	if (indx == -1) {
1153 		struct filecaps *fcaps;
1154 
1155 #ifdef CAPABILITIES
1156 		if (nd.ni_strictrelative == 1)
1157 			fcaps = &nd.ni_filecaps;
1158 		else
1159 #endif
1160 			fcaps = NULL;
1161 		error = finstall(td, fp, &indx, flags, fcaps);
1162 		/* On success finstall() consumes fcaps. */
1163 		if (error != 0) {
1164 			filecaps_free(&nd.ni_filecaps);
1165 			goto bad;
1166 		}
1167 	} else {
1168 		filecaps_free(&nd.ni_filecaps);
1169 	}
1170 
1171 	/*
1172 	 * Release our private reference, leaving the one associated with
1173 	 * the descriptor table intact.
1174 	 */
1175 	fdrop(fp, td);
1176 	td->td_retval[0] = indx;
1177 	return (0);
1178 bad:
1179 	KASSERT(indx == -1, ("indx=%d, should be -1", indx));
1180 	fdrop(fp, td);
1181 	return (error);
1182 }
1183 
1184 #ifdef COMPAT_43
1185 /*
1186  * Create a file.
1187  */
1188 #ifndef _SYS_SYSPROTO_H_
1189 struct ocreat_args {
1190 	char	*path;
1191 	int	mode;
1192 };
1193 #endif
1194 int
1195 ocreat(td, uap)
1196 	struct thread *td;
1197 	register struct ocreat_args /* {
1198 		char *path;
1199 		int mode;
1200 	} */ *uap;
1201 {
1202 
1203 	return (kern_open(td, uap->path, UIO_USERSPACE,
1204 	    O_WRONLY | O_CREAT | O_TRUNC, uap->mode));
1205 }
1206 #endif /* COMPAT_43 */
1207 
1208 /*
1209  * Create a special file.
1210  */
1211 #ifndef _SYS_SYSPROTO_H_
1212 struct mknod_args {
1213 	char	*path;
1214 	int	mode;
1215 	int	dev;
1216 };
1217 #endif
1218 int
1219 sys_mknod(td, uap)
1220 	struct thread *td;
1221 	register struct mknod_args /* {
1222 		char *path;
1223 		int mode;
1224 		int dev;
1225 	} */ *uap;
1226 {
1227 
1228 	return (kern_mknod(td, uap->path, UIO_USERSPACE, uap->mode, uap->dev));
1229 }
1230 
1231 #ifndef _SYS_SYSPROTO_H_
1232 struct mknodat_args {
1233 	int	fd;
1234 	char	*path;
1235 	mode_t	mode;
1236 	dev_t	dev;
1237 };
1238 #endif
1239 int
1240 sys_mknodat(struct thread *td, struct mknodat_args *uap)
1241 {
1242 
1243 	return (kern_mknodat(td, uap->fd, uap->path, UIO_USERSPACE, uap->mode,
1244 	    uap->dev));
1245 }
1246 
1247 int
1248 kern_mknod(struct thread *td, char *path, enum uio_seg pathseg, int mode,
1249     int dev)
1250 {
1251 
1252 	return (kern_mknodat(td, AT_FDCWD, path, pathseg, mode, dev));
1253 }
1254 
1255 int
1256 kern_mknodat(struct thread *td, int fd, char *path, enum uio_seg pathseg,
1257     int mode, int dev)
1258 {
1259 	struct vnode *vp;
1260 	struct mount *mp;
1261 	struct vattr vattr;
1262 	int error;
1263 	int whiteout = 0;
1264 	struct nameidata nd;
1265 
1266 	AUDIT_ARG_MODE(mode);
1267 	AUDIT_ARG_DEV(dev);
1268 	switch (mode & S_IFMT) {
1269 	case S_IFCHR:
1270 	case S_IFBLK:
1271 		error = priv_check(td, PRIV_VFS_MKNOD_DEV);
1272 		break;
1273 	case S_IFMT:
1274 		error = priv_check(td, PRIV_VFS_MKNOD_BAD);
1275 		break;
1276 	case S_IFWHT:
1277 		error = priv_check(td, PRIV_VFS_MKNOD_WHT);
1278 		break;
1279 	case S_IFIFO:
1280 		if (dev == 0)
1281 			return (kern_mkfifoat(td, fd, path, pathseg, mode));
1282 		/* FALLTHROUGH */
1283 	default:
1284 		error = EINVAL;
1285 		break;
1286 	}
1287 	if (error)
1288 		return (error);
1289 restart:
1290 	bwillwrite();
1291 	NDINIT_ATRIGHTS(&nd, CREATE, LOCKPARENT | SAVENAME | AUDITVNODE1,
1292 	    pathseg, path, fd, CAP_MKNODAT, td);
1293 	if ((error = namei(&nd)) != 0)
1294 		return (error);
1295 	vp = nd.ni_vp;
1296 	if (vp != NULL) {
1297 		NDFREE(&nd, NDF_ONLY_PNBUF);
1298 		if (vp == nd.ni_dvp)
1299 			vrele(nd.ni_dvp);
1300 		else
1301 			vput(nd.ni_dvp);
1302 		vrele(vp);
1303 		return (EEXIST);
1304 	} else {
1305 		VATTR_NULL(&vattr);
1306 		vattr.va_mode = (mode & ALLPERMS) &
1307 		    ~td->td_proc->p_fd->fd_cmask;
1308 		vattr.va_rdev = dev;
1309 		whiteout = 0;
1310 
1311 		switch (mode & S_IFMT) {
1312 		case S_IFMT:	/* used by badsect to flag bad sectors */
1313 			vattr.va_type = VBAD;
1314 			break;
1315 		case S_IFCHR:
1316 			vattr.va_type = VCHR;
1317 			break;
1318 		case S_IFBLK:
1319 			vattr.va_type = VBLK;
1320 			break;
1321 		case S_IFWHT:
1322 			whiteout = 1;
1323 			break;
1324 		default:
1325 			panic("kern_mknod: invalid mode");
1326 		}
1327 	}
1328 	if (vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) {
1329 		NDFREE(&nd, NDF_ONLY_PNBUF);
1330 		vput(nd.ni_dvp);
1331 		if ((error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH)) != 0)
1332 			return (error);
1333 		goto restart;
1334 	}
1335 #ifdef MAC
1336 	if (error == 0 && !whiteout)
1337 		error = mac_vnode_check_create(td->td_ucred, nd.ni_dvp,
1338 		    &nd.ni_cnd, &vattr);
1339 #endif
1340 	if (!error) {
1341 		if (whiteout)
1342 			error = VOP_WHITEOUT(nd.ni_dvp, &nd.ni_cnd, CREATE);
1343 		else {
1344 			error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp,
1345 						&nd.ni_cnd, &vattr);
1346 			if (error == 0)
1347 				vput(nd.ni_vp);
1348 		}
1349 	}
1350 	NDFREE(&nd, NDF_ONLY_PNBUF);
1351 	vput(nd.ni_dvp);
1352 	vn_finished_write(mp);
1353 	return (error);
1354 }
1355 
1356 /*
1357  * Create a named pipe.
1358  */
1359 #ifndef _SYS_SYSPROTO_H_
1360 struct mkfifo_args {
1361 	char	*path;
1362 	int	mode;
1363 };
1364 #endif
1365 int
1366 sys_mkfifo(td, uap)
1367 	struct thread *td;
1368 	register struct mkfifo_args /* {
1369 		char *path;
1370 		int mode;
1371 	} */ *uap;
1372 {
1373 
1374 	return (kern_mkfifo(td, uap->path, UIO_USERSPACE, uap->mode));
1375 }
1376 
1377 #ifndef _SYS_SYSPROTO_H_
1378 struct mkfifoat_args {
1379 	int	fd;
1380 	char	*path;
1381 	mode_t	mode;
1382 };
1383 #endif
1384 int
1385 sys_mkfifoat(struct thread *td, struct mkfifoat_args *uap)
1386 {
1387 
1388 	return (kern_mkfifoat(td, uap->fd, uap->path, UIO_USERSPACE,
1389 	    uap->mode));
1390 }
1391 
1392 int
1393 kern_mkfifo(struct thread *td, char *path, enum uio_seg pathseg, int mode)
1394 {
1395 
1396 	return (kern_mkfifoat(td, AT_FDCWD, path, pathseg, mode));
1397 }
1398 
1399 int
1400 kern_mkfifoat(struct thread *td, int fd, char *path, enum uio_seg pathseg,
1401     int mode)
1402 {
1403 	struct mount *mp;
1404 	struct vattr vattr;
1405 	int error;
1406 	struct nameidata nd;
1407 
1408 	AUDIT_ARG_MODE(mode);
1409 restart:
1410 	bwillwrite();
1411 	NDINIT_ATRIGHTS(&nd, CREATE, LOCKPARENT | SAVENAME | AUDITVNODE1,
1412 	    pathseg, path, fd, CAP_MKFIFOAT, td);
1413 	if ((error = namei(&nd)) != 0)
1414 		return (error);
1415 	if (nd.ni_vp != NULL) {
1416 		NDFREE(&nd, NDF_ONLY_PNBUF);
1417 		if (nd.ni_vp == nd.ni_dvp)
1418 			vrele(nd.ni_dvp);
1419 		else
1420 			vput(nd.ni_dvp);
1421 		vrele(nd.ni_vp);
1422 		return (EEXIST);
1423 	}
1424 	if (vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) {
1425 		NDFREE(&nd, NDF_ONLY_PNBUF);
1426 		vput(nd.ni_dvp);
1427 		if ((error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH)) != 0)
1428 			return (error);
1429 		goto restart;
1430 	}
1431 	VATTR_NULL(&vattr);
1432 	vattr.va_type = VFIFO;
1433 	vattr.va_mode = (mode & ALLPERMS) & ~td->td_proc->p_fd->fd_cmask;
1434 #ifdef MAC
1435 	error = mac_vnode_check_create(td->td_ucred, nd.ni_dvp, &nd.ni_cnd,
1436 	    &vattr);
1437 	if (error)
1438 		goto out;
1439 #endif
1440 	error = VOP_MKNOD(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr);
1441 	if (error == 0)
1442 		vput(nd.ni_vp);
1443 #ifdef MAC
1444 out:
1445 #endif
1446 	vput(nd.ni_dvp);
1447 	vn_finished_write(mp);
1448 	NDFREE(&nd, NDF_ONLY_PNBUF);
1449 	return (error);
1450 }
1451 
1452 /*
1453  * Make a hard file link.
1454  */
1455 #ifndef _SYS_SYSPROTO_H_
1456 struct link_args {
1457 	char	*path;
1458 	char	*link;
1459 };
1460 #endif
1461 int
1462 sys_link(td, uap)
1463 	struct thread *td;
1464 	register struct link_args /* {
1465 		char *path;
1466 		char *link;
1467 	} */ *uap;
1468 {
1469 
1470 	return (kern_link(td, uap->path, uap->link, UIO_USERSPACE));
1471 }
1472 
1473 #ifndef _SYS_SYSPROTO_H_
1474 struct linkat_args {
1475 	int	fd1;
1476 	char	*path1;
1477 	int	fd2;
1478 	char	*path2;
1479 	int	flag;
1480 };
1481 #endif
1482 int
1483 sys_linkat(struct thread *td, struct linkat_args *uap)
1484 {
1485 	int flag;
1486 
1487 	flag = uap->flag;
1488 	if (flag & ~AT_SYMLINK_FOLLOW)
1489 		return (EINVAL);
1490 
1491 	return (kern_linkat(td, uap->fd1, uap->fd2, uap->path1, uap->path2,
1492 	    UIO_USERSPACE, (flag & AT_SYMLINK_FOLLOW) ? FOLLOW : NOFOLLOW));
1493 }
1494 
1495 int hardlink_check_uid = 0;
1496 SYSCTL_INT(_security_bsd, OID_AUTO, hardlink_check_uid, CTLFLAG_RW,
1497     &hardlink_check_uid, 0,
1498     "Unprivileged processes cannot create hard links to files owned by other "
1499     "users");
1500 static int hardlink_check_gid = 0;
1501 SYSCTL_INT(_security_bsd, OID_AUTO, hardlink_check_gid, CTLFLAG_RW,
1502     &hardlink_check_gid, 0,
1503     "Unprivileged processes cannot create hard links to files owned by other "
1504     "groups");
1505 
1506 static int
1507 can_hardlink(struct vnode *vp, struct ucred *cred)
1508 {
1509 	struct vattr va;
1510 	int error;
1511 
1512 	if (!hardlink_check_uid && !hardlink_check_gid)
1513 		return (0);
1514 
1515 	error = VOP_GETATTR(vp, &va, cred);
1516 	if (error != 0)
1517 		return (error);
1518 
1519 	if (hardlink_check_uid && cred->cr_uid != va.va_uid) {
1520 		error = priv_check_cred(cred, PRIV_VFS_LINK, 0);
1521 		if (error)
1522 			return (error);
1523 	}
1524 
1525 	if (hardlink_check_gid && !groupmember(va.va_gid, cred)) {
1526 		error = priv_check_cred(cred, PRIV_VFS_LINK, 0);
1527 		if (error)
1528 			return (error);
1529 	}
1530 
1531 	return (0);
1532 }
1533 
1534 int
1535 kern_link(struct thread *td, char *path, char *link, enum uio_seg segflg)
1536 {
1537 
1538 	return (kern_linkat(td, AT_FDCWD, AT_FDCWD, path,link, segflg, FOLLOW));
1539 }
1540 
1541 int
1542 kern_linkat(struct thread *td, int fd1, int fd2, char *path1, char *path2,
1543     enum uio_seg segflg, int follow)
1544 {
1545 	struct vnode *vp;
1546 	struct mount *mp;
1547 	struct nameidata nd;
1548 	int error;
1549 
1550 	bwillwrite();
1551 	NDINIT_AT(&nd, LOOKUP, follow | AUDITVNODE1, segflg, path1, fd1, td);
1552 
1553 	if ((error = namei(&nd)) != 0)
1554 		return (error);
1555 	NDFREE(&nd, NDF_ONLY_PNBUF);
1556 	vp = nd.ni_vp;
1557 	if (vp->v_type == VDIR) {
1558 		vrele(vp);
1559 		return (EPERM);		/* POSIX */
1560 	}
1561 	if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) {
1562 		vrele(vp);
1563 		return (error);
1564 	}
1565 	NDINIT_ATRIGHTS(&nd, CREATE, LOCKPARENT | SAVENAME | AUDITVNODE2,
1566 	    segflg, path2, fd2, CAP_LINKAT, td);
1567 	if ((error = namei(&nd)) == 0) {
1568 		if (nd.ni_vp != NULL) {
1569 			if (nd.ni_dvp == nd.ni_vp)
1570 				vrele(nd.ni_dvp);
1571 			else
1572 				vput(nd.ni_dvp);
1573 			vrele(nd.ni_vp);
1574 			error = EEXIST;
1575 		} else if ((error = vn_lock(vp, LK_EXCLUSIVE | LK_RETRY))
1576 		    == 0) {
1577 			error = can_hardlink(vp, td->td_ucred);
1578 			if (error == 0)
1579 #ifdef MAC
1580 				error = mac_vnode_check_link(td->td_ucred,
1581 				    nd.ni_dvp, vp, &nd.ni_cnd);
1582 			if (error == 0)
1583 #endif
1584 				error = VOP_LINK(nd.ni_dvp, vp, &nd.ni_cnd);
1585 			VOP_UNLOCK(vp, 0);
1586 			vput(nd.ni_dvp);
1587 		}
1588 		NDFREE(&nd, NDF_ONLY_PNBUF);
1589 	}
1590 	vrele(vp);
1591 	vn_finished_write(mp);
1592 	return (error);
1593 }
1594 
1595 /*
1596  * Make a symbolic link.
1597  */
1598 #ifndef _SYS_SYSPROTO_H_
1599 struct symlink_args {
1600 	char	*path;
1601 	char	*link;
1602 };
1603 #endif
1604 int
1605 sys_symlink(td, uap)
1606 	struct thread *td;
1607 	register struct symlink_args /* {
1608 		char *path;
1609 		char *link;
1610 	} */ *uap;
1611 {
1612 
1613 	return (kern_symlink(td, uap->path, uap->link, UIO_USERSPACE));
1614 }
1615 
1616 #ifndef _SYS_SYSPROTO_H_
1617 struct symlinkat_args {
1618 	char	*path;
1619 	int	fd;
1620 	char	*path2;
1621 };
1622 #endif
1623 int
1624 sys_symlinkat(struct thread *td, struct symlinkat_args *uap)
1625 {
1626 
1627 	return (kern_symlinkat(td, uap->path1, uap->fd, uap->path2,
1628 	    UIO_USERSPACE));
1629 }
1630 
1631 int
1632 kern_symlink(struct thread *td, char *path, char *link, enum uio_seg segflg)
1633 {
1634 
1635 	return (kern_symlinkat(td, path, AT_FDCWD, link, segflg));
1636 }
1637 
1638 int
1639 kern_symlinkat(struct thread *td, char *path1, int fd, char *path2,
1640     enum uio_seg segflg)
1641 {
1642 	struct mount *mp;
1643 	struct vattr vattr;
1644 	char *syspath;
1645 	int error;
1646 	struct nameidata nd;
1647 
1648 	if (segflg == UIO_SYSSPACE) {
1649 		syspath = path1;
1650 	} else {
1651 		syspath = uma_zalloc(namei_zone, M_WAITOK);
1652 		if ((error = copyinstr(path1, syspath, MAXPATHLEN, NULL)) != 0)
1653 			goto out;
1654 	}
1655 	AUDIT_ARG_TEXT(syspath);
1656 restart:
1657 	bwillwrite();
1658 	NDINIT_ATRIGHTS(&nd, CREATE, LOCKPARENT | SAVENAME | AUDITVNODE1,
1659 	    segflg, path2, fd, CAP_SYMLINKAT, td);
1660 	if ((error = namei(&nd)) != 0)
1661 		goto out;
1662 	if (nd.ni_vp) {
1663 		NDFREE(&nd, NDF_ONLY_PNBUF);
1664 		if (nd.ni_vp == nd.ni_dvp)
1665 			vrele(nd.ni_dvp);
1666 		else
1667 			vput(nd.ni_dvp);
1668 		vrele(nd.ni_vp);
1669 		error = EEXIST;
1670 		goto out;
1671 	}
1672 	if (vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) {
1673 		NDFREE(&nd, NDF_ONLY_PNBUF);
1674 		vput(nd.ni_dvp);
1675 		if ((error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH)) != 0)
1676 			goto out;
1677 		goto restart;
1678 	}
1679 	VATTR_NULL(&vattr);
1680 	vattr.va_mode = ACCESSPERMS &~ td->td_proc->p_fd->fd_cmask;
1681 #ifdef MAC
1682 	vattr.va_type = VLNK;
1683 	error = mac_vnode_check_create(td->td_ucred, nd.ni_dvp, &nd.ni_cnd,
1684 	    &vattr);
1685 	if (error)
1686 		goto out2;
1687 #endif
1688 	error = VOP_SYMLINK(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr, syspath);
1689 	if (error == 0)
1690 		vput(nd.ni_vp);
1691 #ifdef MAC
1692 out2:
1693 #endif
1694 	NDFREE(&nd, NDF_ONLY_PNBUF);
1695 	vput(nd.ni_dvp);
1696 	vn_finished_write(mp);
1697 out:
1698 	if (segflg != UIO_SYSSPACE)
1699 		uma_zfree(namei_zone, syspath);
1700 	return (error);
1701 }
1702 
1703 /*
1704  * Delete a whiteout from the filesystem.
1705  */
1706 int
1707 sys_undelete(td, uap)
1708 	struct thread *td;
1709 	register struct undelete_args /* {
1710 		char *path;
1711 	} */ *uap;
1712 {
1713 	int error;
1714 	struct mount *mp;
1715 	struct nameidata nd;
1716 
1717 restart:
1718 	bwillwrite();
1719 	NDINIT(&nd, DELETE, LOCKPARENT | DOWHITEOUT | AUDITVNODE1,
1720 	    UIO_USERSPACE, uap->path, td);
1721 	error = namei(&nd);
1722 	if (error)
1723 		return (error);
1724 
1725 	if (nd.ni_vp != NULLVP || !(nd.ni_cnd.cn_flags & ISWHITEOUT)) {
1726 		NDFREE(&nd, NDF_ONLY_PNBUF);
1727 		if (nd.ni_vp == nd.ni_dvp)
1728 			vrele(nd.ni_dvp);
1729 		else
1730 			vput(nd.ni_dvp);
1731 		if (nd.ni_vp)
1732 			vrele(nd.ni_vp);
1733 		return (EEXIST);
1734 	}
1735 	if (vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) {
1736 		NDFREE(&nd, NDF_ONLY_PNBUF);
1737 		vput(nd.ni_dvp);
1738 		if ((error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH)) != 0)
1739 			return (error);
1740 		goto restart;
1741 	}
1742 	error = VOP_WHITEOUT(nd.ni_dvp, &nd.ni_cnd, DELETE);
1743 	NDFREE(&nd, NDF_ONLY_PNBUF);
1744 	vput(nd.ni_dvp);
1745 	vn_finished_write(mp);
1746 	return (error);
1747 }
1748 
1749 /*
1750  * Delete a name from the filesystem.
1751  */
1752 #ifndef _SYS_SYSPROTO_H_
1753 struct unlink_args {
1754 	char	*path;
1755 };
1756 #endif
1757 int
1758 sys_unlink(td, uap)
1759 	struct thread *td;
1760 	struct unlink_args /* {
1761 		char *path;
1762 	} */ *uap;
1763 {
1764 
1765 	return (kern_unlink(td, uap->path, UIO_USERSPACE));
1766 }
1767 
1768 #ifndef _SYS_SYSPROTO_H_
1769 struct unlinkat_args {
1770 	int	fd;
1771 	char	*path;
1772 	int	flag;
1773 };
1774 #endif
1775 int
1776 sys_unlinkat(struct thread *td, struct unlinkat_args *uap)
1777 {
1778 	int flag = uap->flag;
1779 	int fd = uap->fd;
1780 	char *path = uap->path;
1781 
1782 	if (flag & ~AT_REMOVEDIR)
1783 		return (EINVAL);
1784 
1785 	if (flag & AT_REMOVEDIR)
1786 		return (kern_rmdirat(td, fd, path, UIO_USERSPACE));
1787 	else
1788 		return (kern_unlinkat(td, fd, path, UIO_USERSPACE, 0));
1789 }
1790 
1791 int
1792 kern_unlink(struct thread *td, char *path, enum uio_seg pathseg)
1793 {
1794 
1795 	return (kern_unlinkat(td, AT_FDCWD, path, pathseg, 0));
1796 }
1797 
1798 int
1799 kern_unlinkat(struct thread *td, int fd, char *path, enum uio_seg pathseg,
1800     ino_t oldinum)
1801 {
1802 	struct mount *mp;
1803 	struct vnode *vp;
1804 	int error;
1805 	struct nameidata nd;
1806 	struct stat sb;
1807 
1808 restart:
1809 	bwillwrite();
1810 	NDINIT_ATRIGHTS(&nd, DELETE, LOCKPARENT | LOCKLEAF | AUDITVNODE1,
1811 	    pathseg, path, fd, CAP_UNLINKAT, td);
1812 	if ((error = namei(&nd)) != 0)
1813 		return (error == EINVAL ? EPERM : error);
1814 	vp = nd.ni_vp;
1815 	if (vp->v_type == VDIR && oldinum == 0) {
1816 		error = EPERM;		/* POSIX */
1817 	} else if (oldinum != 0 &&
1818 		  ((error = vn_stat(vp, &sb, td->td_ucred, NOCRED, td)) == 0) &&
1819 		  sb.st_ino != oldinum) {
1820 			error = EIDRM;	/* Identifier removed */
1821 	} else {
1822 		/*
1823 		 * The root of a mounted filesystem cannot be deleted.
1824 		 *
1825 		 * XXX: can this only be a VDIR case?
1826 		 */
1827 		if (vp->v_vflag & VV_ROOT)
1828 			error = EBUSY;
1829 	}
1830 	if (error == 0) {
1831 		if (vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) {
1832 			NDFREE(&nd, NDF_ONLY_PNBUF);
1833 			vput(nd.ni_dvp);
1834 			if (vp == nd.ni_dvp)
1835 				vrele(vp);
1836 			else
1837 				vput(vp);
1838 			if ((error = vn_start_write(NULL, &mp,
1839 			    V_XSLEEP | PCATCH)) != 0)
1840 				return (error);
1841 			goto restart;
1842 		}
1843 #ifdef MAC
1844 		error = mac_vnode_check_unlink(td->td_ucred, nd.ni_dvp, vp,
1845 		    &nd.ni_cnd);
1846 		if (error)
1847 			goto out;
1848 #endif
1849 		error = VOP_REMOVE(nd.ni_dvp, vp, &nd.ni_cnd);
1850 #ifdef MAC
1851 out:
1852 #endif
1853 		vn_finished_write(mp);
1854 	}
1855 	NDFREE(&nd, NDF_ONLY_PNBUF);
1856 	vput(nd.ni_dvp);
1857 	if (vp == nd.ni_dvp)
1858 		vrele(vp);
1859 	else
1860 		vput(vp);
1861 	return (error);
1862 }
1863 
1864 /*
1865  * Reposition read/write file offset.
1866  */
1867 #ifndef _SYS_SYSPROTO_H_
1868 struct lseek_args {
1869 	int	fd;
1870 	int	pad;
1871 	off_t	offset;
1872 	int	whence;
1873 };
1874 #endif
1875 int
1876 sys_lseek(td, uap)
1877 	struct thread *td;
1878 	register struct lseek_args /* {
1879 		int fd;
1880 		int pad;
1881 		off_t offset;
1882 		int whence;
1883 	} */ *uap;
1884 {
1885 	struct ucred *cred = td->td_ucred;
1886 	struct file *fp;
1887 	struct vnode *vp;
1888 	struct vattr vattr;
1889 	off_t foffset, offset, size;
1890 	int error, noneg;
1891 
1892 	AUDIT_ARG_FD(uap->fd);
1893 	if ((error = fget(td, uap->fd, CAP_SEEK, &fp)) != 0)
1894 		return (error);
1895 	if (!(fp->f_ops->fo_flags & DFLAG_SEEKABLE)) {
1896 		fdrop(fp, td);
1897 		return (ESPIPE);
1898 	}
1899 	vp = fp->f_vnode;
1900 	foffset = foffset_lock(fp, 0);
1901 	noneg = (vp->v_type != VCHR);
1902 	offset = uap->offset;
1903 	switch (uap->whence) {
1904 	case L_INCR:
1905 		if (noneg &&
1906 		    (foffset < 0 ||
1907 		    (offset > 0 && foffset > OFF_MAX - offset))) {
1908 			error = EOVERFLOW;
1909 			break;
1910 		}
1911 		offset += foffset;
1912 		break;
1913 	case L_XTND:
1914 		vn_lock(vp, LK_SHARED | LK_RETRY);
1915 		error = VOP_GETATTR(vp, &vattr, cred);
1916 		VOP_UNLOCK(vp, 0);
1917 		if (error)
1918 			break;
1919 
1920 		/*
1921 		 * If the file references a disk device, then fetch
1922 		 * the media size and use that to determine the ending
1923 		 * offset.
1924 		 */
1925 		if (vattr.va_size == 0 && vp->v_type == VCHR &&
1926 		    fo_ioctl(fp, DIOCGMEDIASIZE, &size, cred, td) == 0)
1927 			vattr.va_size = size;
1928 		if (noneg &&
1929 		    (vattr.va_size > OFF_MAX ||
1930 		    (offset > 0 && vattr.va_size > OFF_MAX - offset))) {
1931 			error = EOVERFLOW;
1932 			break;
1933 		}
1934 		offset += vattr.va_size;
1935 		break;
1936 	case L_SET:
1937 		break;
1938 	case SEEK_DATA:
1939 		error = fo_ioctl(fp, FIOSEEKDATA, &offset, cred, td);
1940 		break;
1941 	case SEEK_HOLE:
1942 		error = fo_ioctl(fp, FIOSEEKHOLE, &offset, cred, td);
1943 		break;
1944 	default:
1945 		error = EINVAL;
1946 	}
1947 	if (error == 0 && noneg && offset < 0)
1948 		error = EINVAL;
1949 	if (error != 0)
1950 		goto drop;
1951 	VFS_KNOTE_UNLOCKED(vp, 0);
1952 	*(off_t *)(td->td_retval) = offset;
1953 drop:
1954 	fdrop(fp, td);
1955 	foffset_unlock(fp, offset, error != 0 ? FOF_NOUPDATE : 0);
1956 	return (error);
1957 }
1958 
1959 #if defined(COMPAT_43)
1960 /*
1961  * Reposition read/write file offset.
1962  */
1963 #ifndef _SYS_SYSPROTO_H_
1964 struct olseek_args {
1965 	int	fd;
1966 	long	offset;
1967 	int	whence;
1968 };
1969 #endif
1970 int
1971 olseek(td, uap)
1972 	struct thread *td;
1973 	register struct olseek_args /* {
1974 		int fd;
1975 		long offset;
1976 		int whence;
1977 	} */ *uap;
1978 {
1979 	struct lseek_args /* {
1980 		int fd;
1981 		int pad;
1982 		off_t offset;
1983 		int whence;
1984 	} */ nuap;
1985 
1986 	nuap.fd = uap->fd;
1987 	nuap.offset = uap->offset;
1988 	nuap.whence = uap->whence;
1989 	return (sys_lseek(td, &nuap));
1990 }
1991 #endif /* COMPAT_43 */
1992 
1993 /* Version with the 'pad' argument */
1994 int
1995 freebsd6_lseek(td, uap)
1996 	struct thread *td;
1997 	register struct freebsd6_lseek_args *uap;
1998 {
1999 	struct lseek_args ouap;
2000 
2001 	ouap.fd = uap->fd;
2002 	ouap.offset = uap->offset;
2003 	ouap.whence = uap->whence;
2004 	return (sys_lseek(td, &ouap));
2005 }
2006 
2007 /*
2008  * Check access permissions using passed credentials.
2009  */
2010 static int
2011 vn_access(vp, user_flags, cred, td)
2012 	struct vnode	*vp;
2013 	int		user_flags;
2014 	struct ucred	*cred;
2015 	struct thread	*td;
2016 {
2017 	int error;
2018 	accmode_t accmode;
2019 
2020 	/* Flags == 0 means only check for existence. */
2021 	error = 0;
2022 	if (user_flags) {
2023 		accmode = 0;
2024 		if (user_flags & R_OK)
2025 			accmode |= VREAD;
2026 		if (user_flags & W_OK)
2027 			accmode |= VWRITE;
2028 		if (user_flags & X_OK)
2029 			accmode |= VEXEC;
2030 #ifdef MAC
2031 		error = mac_vnode_check_access(cred, vp, accmode);
2032 		if (error)
2033 			return (error);
2034 #endif
2035 		if ((accmode & VWRITE) == 0 || (error = vn_writechk(vp)) == 0)
2036 			error = VOP_ACCESS(vp, accmode, cred, td);
2037 	}
2038 	return (error);
2039 }
2040 
2041 /*
2042  * Check access permissions using "real" credentials.
2043  */
2044 #ifndef _SYS_SYSPROTO_H_
2045 struct access_args {
2046 	char	*path;
2047 	int	amode;
2048 };
2049 #endif
2050 int
2051 sys_access(td, uap)
2052 	struct thread *td;
2053 	register struct access_args /* {
2054 		char *path;
2055 		int amode;
2056 	} */ *uap;
2057 {
2058 
2059 	return (kern_access(td, uap->path, UIO_USERSPACE, uap->amode));
2060 }
2061 
2062 #ifndef _SYS_SYSPROTO_H_
2063 struct faccessat_args {
2064 	int	dirfd;
2065 	char	*path;
2066 	int	amode;
2067 	int	flag;
2068 }
2069 #endif
2070 int
2071 sys_faccessat(struct thread *td, struct faccessat_args *uap)
2072 {
2073 
2074 	if (uap->flag & ~AT_EACCESS)
2075 		return (EINVAL);
2076 	return (kern_accessat(td, uap->fd, uap->path, UIO_USERSPACE, uap->flag,
2077 	    uap->amode));
2078 }
2079 
2080 int
2081 kern_access(struct thread *td, char *path, enum uio_seg pathseg, int amode)
2082 {
2083 
2084 	return (kern_accessat(td, AT_FDCWD, path, pathseg, 0, amode));
2085 }
2086 
2087 int
2088 kern_accessat(struct thread *td, int fd, char *path, enum uio_seg pathseg,
2089     int flag, int amode)
2090 {
2091 	struct ucred *cred, *tmpcred;
2092 	struct vnode *vp;
2093 	struct nameidata nd;
2094 	int error;
2095 
2096 	/*
2097 	 * Create and modify a temporary credential instead of one that
2098 	 * is potentially shared.
2099 	 */
2100 	if (!(flag & AT_EACCESS)) {
2101 		cred = td->td_ucred;
2102 		tmpcred = crdup(cred);
2103 		tmpcred->cr_uid = cred->cr_ruid;
2104 		tmpcred->cr_groups[0] = cred->cr_rgid;
2105 		td->td_ucred = tmpcred;
2106 	} else
2107 		cred = tmpcred = td->td_ucred;
2108 	AUDIT_ARG_VALUE(amode);
2109 	NDINIT_ATRIGHTS(&nd, LOOKUP, FOLLOW | LOCKSHARED | LOCKLEAF |
2110 	    AUDITVNODE1, pathseg, path, fd, CAP_FSTAT, td);
2111 	if ((error = namei(&nd)) != 0)
2112 		goto out1;
2113 	vp = nd.ni_vp;
2114 
2115 	error = vn_access(vp, amode, tmpcred, td);
2116 	NDFREE(&nd, NDF_ONLY_PNBUF);
2117 	vput(vp);
2118 out1:
2119 	if (!(flag & AT_EACCESS)) {
2120 		td->td_ucred = cred;
2121 		crfree(tmpcred);
2122 	}
2123 	return (error);
2124 }
2125 
2126 /*
2127  * Check access permissions using "effective" credentials.
2128  */
2129 #ifndef _SYS_SYSPROTO_H_
2130 struct eaccess_args {
2131 	char	*path;
2132 	int	amode;
2133 };
2134 #endif
2135 int
2136 sys_eaccess(td, uap)
2137 	struct thread *td;
2138 	register struct eaccess_args /* {
2139 		char *path;
2140 		int amode;
2141 	} */ *uap;
2142 {
2143 
2144 	return (kern_eaccess(td, uap->path, UIO_USERSPACE, uap->amode));
2145 }
2146 
2147 int
2148 kern_eaccess(struct thread *td, char *path, enum uio_seg pathseg, int amode)
2149 {
2150 
2151 	return (kern_accessat(td, AT_FDCWD, path, pathseg, AT_EACCESS, amode));
2152 }
2153 
2154 #if defined(COMPAT_43)
2155 /*
2156  * Get file status; this version follows links.
2157  */
2158 #ifndef _SYS_SYSPROTO_H_
2159 struct ostat_args {
2160 	char	*path;
2161 	struct ostat *ub;
2162 };
2163 #endif
2164 int
2165 ostat(td, uap)
2166 	struct thread *td;
2167 	register struct ostat_args /* {
2168 		char *path;
2169 		struct ostat *ub;
2170 	} */ *uap;
2171 {
2172 	struct stat sb;
2173 	struct ostat osb;
2174 	int error;
2175 
2176 	error = kern_stat(td, uap->path, UIO_USERSPACE, &sb);
2177 	if (error)
2178 		return (error);
2179 	cvtstat(&sb, &osb);
2180 	error = copyout(&osb, uap->ub, sizeof (osb));
2181 	return (error);
2182 }
2183 
2184 /*
2185  * Get file status; this version does not follow links.
2186  */
2187 #ifndef _SYS_SYSPROTO_H_
2188 struct olstat_args {
2189 	char	*path;
2190 	struct ostat *ub;
2191 };
2192 #endif
2193 int
2194 olstat(td, uap)
2195 	struct thread *td;
2196 	register struct olstat_args /* {
2197 		char *path;
2198 		struct ostat *ub;
2199 	} */ *uap;
2200 {
2201 	struct stat sb;
2202 	struct ostat osb;
2203 	int error;
2204 
2205 	error = kern_lstat(td, uap->path, UIO_USERSPACE, &sb);
2206 	if (error)
2207 		return (error);
2208 	cvtstat(&sb, &osb);
2209 	error = copyout(&osb, uap->ub, sizeof (osb));
2210 	return (error);
2211 }
2212 
2213 /*
2214  * Convert from an old to a new stat structure.
2215  */
2216 void
2217 cvtstat(st, ost)
2218 	struct stat *st;
2219 	struct ostat *ost;
2220 {
2221 
2222 	ost->st_dev = st->st_dev;
2223 	ost->st_ino = st->st_ino;
2224 	ost->st_mode = st->st_mode;
2225 	ost->st_nlink = st->st_nlink;
2226 	ost->st_uid = st->st_uid;
2227 	ost->st_gid = st->st_gid;
2228 	ost->st_rdev = st->st_rdev;
2229 	if (st->st_size < (quad_t)1 << 32)
2230 		ost->st_size = st->st_size;
2231 	else
2232 		ost->st_size = -2;
2233 	ost->st_atim = st->st_atim;
2234 	ost->st_mtim = st->st_mtim;
2235 	ost->st_ctim = st->st_ctim;
2236 	ost->st_blksize = st->st_blksize;
2237 	ost->st_blocks = st->st_blocks;
2238 	ost->st_flags = st->st_flags;
2239 	ost->st_gen = st->st_gen;
2240 }
2241 #endif /* COMPAT_43 */
2242 
2243 /*
2244  * Get file status; this version follows links.
2245  */
2246 #ifndef _SYS_SYSPROTO_H_
2247 struct stat_args {
2248 	char	*path;
2249 	struct stat *ub;
2250 };
2251 #endif
2252 int
2253 sys_stat(td, uap)
2254 	struct thread *td;
2255 	register struct stat_args /* {
2256 		char *path;
2257 		struct stat *ub;
2258 	} */ *uap;
2259 {
2260 	struct stat sb;
2261 	int error;
2262 
2263 	error = kern_stat(td, uap->path, UIO_USERSPACE, &sb);
2264 	if (error == 0)
2265 		error = copyout(&sb, uap->ub, sizeof (sb));
2266 	return (error);
2267 }
2268 
2269 #ifndef _SYS_SYSPROTO_H_
2270 struct fstatat_args {
2271 	int	fd;
2272 	char	*path;
2273 	struct stat	*buf;
2274 	int	flag;
2275 }
2276 #endif
2277 int
2278 sys_fstatat(struct thread *td, struct fstatat_args *uap)
2279 {
2280 	struct stat sb;
2281 	int error;
2282 
2283 	error = kern_statat(td, uap->flag, uap->fd, uap->path,
2284 	    UIO_USERSPACE, &sb);
2285 	if (error == 0)
2286 		error = copyout(&sb, uap->buf, sizeof (sb));
2287 	return (error);
2288 }
2289 
2290 int
2291 kern_stat(struct thread *td, char *path, enum uio_seg pathseg, struct stat *sbp)
2292 {
2293 
2294 	return (kern_statat(td, 0, AT_FDCWD, path, pathseg, sbp));
2295 }
2296 
2297 int
2298 kern_statat(struct thread *td, int flag, int fd, char *path,
2299     enum uio_seg pathseg, struct stat *sbp)
2300 {
2301 
2302 	return (kern_statat_vnhook(td, flag, fd, path, pathseg, sbp, NULL));
2303 }
2304 
2305 int
2306 kern_statat_vnhook(struct thread *td, int flag, int fd, char *path,
2307     enum uio_seg pathseg, struct stat *sbp,
2308     void (*hook)(struct vnode *vp, struct stat *sbp))
2309 {
2310 	struct nameidata nd;
2311 	struct stat sb;
2312 	int error;
2313 
2314 	if (flag & ~AT_SYMLINK_NOFOLLOW)
2315 		return (EINVAL);
2316 
2317 	NDINIT_ATRIGHTS(&nd, LOOKUP, ((flag & AT_SYMLINK_NOFOLLOW) ? NOFOLLOW :
2318 	    FOLLOW) | LOCKSHARED | LOCKLEAF | AUDITVNODE1, pathseg, path, fd,
2319 	    CAP_FSTAT, td);
2320 
2321 	if ((error = namei(&nd)) != 0)
2322 		return (error);
2323 	error = vn_stat(nd.ni_vp, &sb, td->td_ucred, NOCRED, td);
2324 	if (!error) {
2325 		SDT_PROBE(vfs, , stat, mode, path, sb.st_mode, 0, 0, 0);
2326 		if (S_ISREG(sb.st_mode))
2327 			SDT_PROBE(vfs, , stat, reg, path, pathseg, 0, 0, 0);
2328 		if (__predict_false(hook != NULL))
2329 			hook(nd.ni_vp, &sb);
2330 	}
2331 	NDFREE(&nd, NDF_ONLY_PNBUF);
2332 	vput(nd.ni_vp);
2333 	if (error)
2334 		return (error);
2335 	*sbp = sb;
2336 #ifdef KTRACE
2337 	if (KTRPOINT(td, KTR_STRUCT))
2338 		ktrstat(&sb);
2339 #endif
2340 	return (0);
2341 }
2342 
2343 /*
2344  * Get file status; this version does not follow links.
2345  */
2346 #ifndef _SYS_SYSPROTO_H_
2347 struct lstat_args {
2348 	char	*path;
2349 	struct stat *ub;
2350 };
2351 #endif
2352 int
2353 sys_lstat(td, uap)
2354 	struct thread *td;
2355 	register struct lstat_args /* {
2356 		char *path;
2357 		struct stat *ub;
2358 	} */ *uap;
2359 {
2360 	struct stat sb;
2361 	int error;
2362 
2363 	error = kern_lstat(td, uap->path, UIO_USERSPACE, &sb);
2364 	if (error == 0)
2365 		error = copyout(&sb, uap->ub, sizeof (sb));
2366 	return (error);
2367 }
2368 
2369 int
2370 kern_lstat(struct thread *td, char *path, enum uio_seg pathseg, struct stat *sbp)
2371 {
2372 
2373 	return (kern_statat(td, AT_SYMLINK_NOFOLLOW, AT_FDCWD, path, pathseg,
2374 	    sbp));
2375 }
2376 
2377 /*
2378  * Implementation of the NetBSD [l]stat() functions.
2379  */
2380 void
2381 cvtnstat(sb, nsb)
2382 	struct stat *sb;
2383 	struct nstat *nsb;
2384 {
2385 	bzero(nsb, sizeof *nsb);
2386 	nsb->st_dev = sb->st_dev;
2387 	nsb->st_ino = sb->st_ino;
2388 	nsb->st_mode = sb->st_mode;
2389 	nsb->st_nlink = sb->st_nlink;
2390 	nsb->st_uid = sb->st_uid;
2391 	nsb->st_gid = sb->st_gid;
2392 	nsb->st_rdev = sb->st_rdev;
2393 	nsb->st_atim = sb->st_atim;
2394 	nsb->st_mtim = sb->st_mtim;
2395 	nsb->st_ctim = sb->st_ctim;
2396 	nsb->st_size = sb->st_size;
2397 	nsb->st_blocks = sb->st_blocks;
2398 	nsb->st_blksize = sb->st_blksize;
2399 	nsb->st_flags = sb->st_flags;
2400 	nsb->st_gen = sb->st_gen;
2401 	nsb->st_birthtim = sb->st_birthtim;
2402 }
2403 
2404 #ifndef _SYS_SYSPROTO_H_
2405 struct nstat_args {
2406 	char	*path;
2407 	struct nstat *ub;
2408 };
2409 #endif
2410 int
2411 sys_nstat(td, uap)
2412 	struct thread *td;
2413 	register struct nstat_args /* {
2414 		char *path;
2415 		struct nstat *ub;
2416 	} */ *uap;
2417 {
2418 	struct stat sb;
2419 	struct nstat nsb;
2420 	int error;
2421 
2422 	error = kern_stat(td, uap->path, UIO_USERSPACE, &sb);
2423 	if (error)
2424 		return (error);
2425 	cvtnstat(&sb, &nsb);
2426 	error = copyout(&nsb, uap->ub, sizeof (nsb));
2427 	return (error);
2428 }
2429 
2430 /*
2431  * NetBSD lstat.  Get file status; this version does not follow links.
2432  */
2433 #ifndef _SYS_SYSPROTO_H_
2434 struct lstat_args {
2435 	char	*path;
2436 	struct stat *ub;
2437 };
2438 #endif
2439 int
2440 sys_nlstat(td, uap)
2441 	struct thread *td;
2442 	register struct nlstat_args /* {
2443 		char *path;
2444 		struct nstat *ub;
2445 	} */ *uap;
2446 {
2447 	struct stat sb;
2448 	struct nstat nsb;
2449 	int error;
2450 
2451 	error = kern_lstat(td, uap->path, UIO_USERSPACE, &sb);
2452 	if (error)
2453 		return (error);
2454 	cvtnstat(&sb, &nsb);
2455 	error = copyout(&nsb, uap->ub, sizeof (nsb));
2456 	return (error);
2457 }
2458 
2459 /*
2460  * Get configurable pathname variables.
2461  */
2462 #ifndef _SYS_SYSPROTO_H_
2463 struct pathconf_args {
2464 	char	*path;
2465 	int	name;
2466 };
2467 #endif
2468 int
2469 sys_pathconf(td, uap)
2470 	struct thread *td;
2471 	register struct pathconf_args /* {
2472 		char *path;
2473 		int name;
2474 	} */ *uap;
2475 {
2476 
2477 	return (kern_pathconf(td, uap->path, UIO_USERSPACE, uap->name, FOLLOW));
2478 }
2479 
2480 #ifndef _SYS_SYSPROTO_H_
2481 struct lpathconf_args {
2482 	char	*path;
2483 	int	name;
2484 };
2485 #endif
2486 int
2487 sys_lpathconf(td, uap)
2488 	struct thread *td;
2489 	register struct lpathconf_args /* {
2490 		char *path;
2491 		int name;
2492 	} */ *uap;
2493 {
2494 
2495 	return (kern_pathconf(td, uap->path, UIO_USERSPACE, uap->name,
2496 	    NOFOLLOW));
2497 }
2498 
2499 int
2500 kern_pathconf(struct thread *td, char *path, enum uio_seg pathseg, int name,
2501     u_long flags)
2502 {
2503 	struct nameidata nd;
2504 	int error;
2505 
2506 	NDINIT(&nd, LOOKUP, LOCKSHARED | LOCKLEAF | AUDITVNODE1 | flags,
2507 	    pathseg, path, td);
2508 	if ((error = namei(&nd)) != 0)
2509 		return (error);
2510 	NDFREE(&nd, NDF_ONLY_PNBUF);
2511 
2512 	/* If asynchronous I/O is available, it works for all files. */
2513 	if (name == _PC_ASYNC_IO)
2514 		td->td_retval[0] = async_io_version;
2515 	else
2516 		error = VOP_PATHCONF(nd.ni_vp, name, td->td_retval);
2517 	vput(nd.ni_vp);
2518 	return (error);
2519 }
2520 
2521 /*
2522  * Return target name of a symbolic link.
2523  */
2524 #ifndef _SYS_SYSPROTO_H_
2525 struct readlink_args {
2526 	char	*path;
2527 	char	*buf;
2528 	size_t	count;
2529 };
2530 #endif
2531 int
2532 sys_readlink(td, uap)
2533 	struct thread *td;
2534 	register struct readlink_args /* {
2535 		char *path;
2536 		char *buf;
2537 		size_t count;
2538 	} */ *uap;
2539 {
2540 
2541 	return (kern_readlink(td, uap->path, UIO_USERSPACE, uap->buf,
2542 	    UIO_USERSPACE, uap->count));
2543 }
2544 #ifndef _SYS_SYSPROTO_H_
2545 struct readlinkat_args {
2546 	int	fd;
2547 	char	*path;
2548 	char	*buf;
2549 	size_t	bufsize;
2550 };
2551 #endif
2552 int
2553 sys_readlinkat(struct thread *td, struct readlinkat_args *uap)
2554 {
2555 
2556 	return (kern_readlinkat(td, uap->fd, uap->path, UIO_USERSPACE,
2557 	    uap->buf, UIO_USERSPACE, uap->bufsize));
2558 }
2559 
2560 int
2561 kern_readlink(struct thread *td, char *path, enum uio_seg pathseg, char *buf,
2562     enum uio_seg bufseg, size_t count)
2563 {
2564 
2565 	return (kern_readlinkat(td, AT_FDCWD, path, pathseg, buf, bufseg,
2566 	    count));
2567 }
2568 
2569 int
2570 kern_readlinkat(struct thread *td, int fd, char *path, enum uio_seg pathseg,
2571     char *buf, enum uio_seg bufseg, size_t count)
2572 {
2573 	struct vnode *vp;
2574 	struct iovec aiov;
2575 	struct uio auio;
2576 	int error;
2577 	struct nameidata nd;
2578 
2579 	if (count > IOSIZE_MAX)
2580 		return (EINVAL);
2581 
2582 	NDINIT_AT(&nd, LOOKUP, NOFOLLOW | LOCKSHARED | LOCKLEAF | AUDITVNODE1,
2583 	    pathseg, path, fd, td);
2584 
2585 	if ((error = namei(&nd)) != 0)
2586 		return (error);
2587 	NDFREE(&nd, NDF_ONLY_PNBUF);
2588 	vp = nd.ni_vp;
2589 #ifdef MAC
2590 	error = mac_vnode_check_readlink(td->td_ucred, vp);
2591 	if (error) {
2592 		vput(vp);
2593 		return (error);
2594 	}
2595 #endif
2596 	if (vp->v_type != VLNK)
2597 		error = EINVAL;
2598 	else {
2599 		aiov.iov_base = buf;
2600 		aiov.iov_len = count;
2601 		auio.uio_iov = &aiov;
2602 		auio.uio_iovcnt = 1;
2603 		auio.uio_offset = 0;
2604 		auio.uio_rw = UIO_READ;
2605 		auio.uio_segflg = bufseg;
2606 		auio.uio_td = td;
2607 		auio.uio_resid = count;
2608 		error = VOP_READLINK(vp, &auio, td->td_ucred);
2609 	}
2610 	vput(vp);
2611 	td->td_retval[0] = count - auio.uio_resid;
2612 	return (error);
2613 }
2614 
2615 /*
2616  * Common implementation code for chflags() and fchflags().
2617  */
2618 static int
2619 setfflags(td, vp, flags)
2620 	struct thread *td;
2621 	struct vnode *vp;
2622 	u_long flags;
2623 {
2624 	int error;
2625 	struct mount *mp;
2626 	struct vattr vattr;
2627 
2628 	/* We can't support the value matching VNOVAL. */
2629 	if (flags == VNOVAL)
2630 		return (EOPNOTSUPP);
2631 
2632 	/*
2633 	 * Prevent non-root users from setting flags on devices.  When
2634 	 * a device is reused, users can retain ownership of the device
2635 	 * if they are allowed to set flags and programs assume that
2636 	 * chown can't fail when done as root.
2637 	 */
2638 	if (vp->v_type == VCHR || vp->v_type == VBLK) {
2639 		error = priv_check(td, PRIV_VFS_CHFLAGS_DEV);
2640 		if (error)
2641 			return (error);
2642 	}
2643 
2644 	if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0)
2645 		return (error);
2646 	VATTR_NULL(&vattr);
2647 	vattr.va_flags = flags;
2648 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
2649 #ifdef MAC
2650 	error = mac_vnode_check_setflags(td->td_ucred, vp, vattr.va_flags);
2651 	if (error == 0)
2652 #endif
2653 		error = VOP_SETATTR(vp, &vattr, td->td_ucred);
2654 	VOP_UNLOCK(vp, 0);
2655 	vn_finished_write(mp);
2656 	return (error);
2657 }
2658 
2659 /*
2660  * Change flags of a file given a path name.
2661  */
2662 #ifndef _SYS_SYSPROTO_H_
2663 struct chflags_args {
2664 	const char *path;
2665 	u_long	flags;
2666 };
2667 #endif
2668 int
2669 sys_chflags(td, uap)
2670 	struct thread *td;
2671 	register struct chflags_args /* {
2672 		const char *path;
2673 		u_long flags;
2674 	} */ *uap;
2675 {
2676 
2677 	return (kern_chflags(td, uap->path, UIO_USERSPACE, uap->flags));
2678 }
2679 
2680 #ifndef _SYS_SYSPROTO_H_
2681 struct chflagsat_args {
2682 	int	fd;
2683 	const char *path;
2684 	u_long	flags;
2685 	int	atflag;
2686 }
2687 #endif
2688 int
2689 sys_chflagsat(struct thread *td, struct chflagsat_args *uap)
2690 {
2691 	int fd = uap->fd;
2692 	const char *path = uap->path;
2693 	u_long flags = uap->flags;
2694 	int atflag = uap->atflag;
2695 
2696 	if (atflag & ~AT_SYMLINK_NOFOLLOW)
2697 		return (EINVAL);
2698 
2699 	return (kern_chflagsat(td, fd, path, UIO_USERSPACE, flags, atflag));
2700 }
2701 
2702 static int
2703 kern_chflags(struct thread *td, const char *path, enum uio_seg pathseg,
2704     u_long flags)
2705 {
2706 
2707 	return (kern_chflagsat(td, AT_FDCWD, path, pathseg, flags, 0));
2708 }
2709 
2710 /*
2711  * Same as chflags() but doesn't follow symlinks.
2712  */
2713 int
2714 sys_lchflags(td, uap)
2715 	struct thread *td;
2716 	register struct lchflags_args /* {
2717 		const char *path;
2718 		u_long flags;
2719 	} */ *uap;
2720 {
2721 
2722 	return (kern_chflagsat(td, AT_FDCWD, uap->path, UIO_USERSPACE,
2723 	    uap->flags, AT_SYMLINK_NOFOLLOW));
2724 }
2725 
2726 static int
2727 kern_chflagsat(struct thread *td, int fd, const char *path,
2728     enum uio_seg pathseg, u_long flags, int atflag)
2729 {
2730 	struct nameidata nd;
2731 	int error, follow;
2732 
2733 	AUDIT_ARG_FFLAGS(flags);
2734 	follow = (atflag & AT_SYMLINK_NOFOLLOW) ? NOFOLLOW : FOLLOW;
2735 	NDINIT_ATRIGHTS(&nd, LOOKUP, follow | AUDITVNODE1, pathseg, path, fd,
2736 	    CAP_FCHFLAGS, td);
2737 	if ((error = namei(&nd)) != 0)
2738 		return (error);
2739 	NDFREE(&nd, NDF_ONLY_PNBUF);
2740 	error = setfflags(td, nd.ni_vp, flags);
2741 	vrele(nd.ni_vp);
2742 	return (error);
2743 }
2744 
2745 /*
2746  * Change flags of a file given a file descriptor.
2747  */
2748 #ifndef _SYS_SYSPROTO_H_
2749 struct fchflags_args {
2750 	int	fd;
2751 	u_long	flags;
2752 };
2753 #endif
2754 int
2755 sys_fchflags(td, uap)
2756 	struct thread *td;
2757 	register struct fchflags_args /* {
2758 		int fd;
2759 		u_long flags;
2760 	} */ *uap;
2761 {
2762 	struct file *fp;
2763 	int error;
2764 
2765 	AUDIT_ARG_FD(uap->fd);
2766 	AUDIT_ARG_FFLAGS(uap->flags);
2767 	if ((error = getvnode(td->td_proc->p_fd, uap->fd, CAP_FCHFLAGS,
2768 	    &fp)) != 0)
2769 		return (error);
2770 #ifdef AUDIT
2771 	vn_lock(fp->f_vnode, LK_SHARED | LK_RETRY);
2772 	AUDIT_ARG_VNODE1(fp->f_vnode);
2773 	VOP_UNLOCK(fp->f_vnode, 0);
2774 #endif
2775 	error = setfflags(td, fp->f_vnode, uap->flags);
2776 	fdrop(fp, td);
2777 	return (error);
2778 }
2779 
2780 /*
2781  * Common implementation code for chmod(), lchmod() and fchmod().
2782  */
2783 int
2784 setfmode(td, cred, vp, mode)
2785 	struct thread *td;
2786 	struct ucred *cred;
2787 	struct vnode *vp;
2788 	int mode;
2789 {
2790 	int error;
2791 	struct mount *mp;
2792 	struct vattr vattr;
2793 
2794 	if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0)
2795 		return (error);
2796 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
2797 	VATTR_NULL(&vattr);
2798 	vattr.va_mode = mode & ALLPERMS;
2799 #ifdef MAC
2800 	error = mac_vnode_check_setmode(cred, vp, vattr.va_mode);
2801 	if (error == 0)
2802 #endif
2803 		error = VOP_SETATTR(vp, &vattr, cred);
2804 	VOP_UNLOCK(vp, 0);
2805 	vn_finished_write(mp);
2806 	return (error);
2807 }
2808 
2809 /*
2810  * Change mode of a file given path name.
2811  */
2812 #ifndef _SYS_SYSPROTO_H_
2813 struct chmod_args {
2814 	char	*path;
2815 	int	mode;
2816 };
2817 #endif
2818 int
2819 sys_chmod(td, uap)
2820 	struct thread *td;
2821 	register struct chmod_args /* {
2822 		char *path;
2823 		int mode;
2824 	} */ *uap;
2825 {
2826 
2827 	return (kern_chmod(td, uap->path, UIO_USERSPACE, uap->mode));
2828 }
2829 
2830 #ifndef _SYS_SYSPROTO_H_
2831 struct fchmodat_args {
2832 	int	dirfd;
2833 	char	*path;
2834 	mode_t	mode;
2835 	int	flag;
2836 }
2837 #endif
2838 int
2839 sys_fchmodat(struct thread *td, struct fchmodat_args *uap)
2840 {
2841 	int flag = uap->flag;
2842 	int fd = uap->fd;
2843 	char *path = uap->path;
2844 	mode_t mode = uap->mode;
2845 
2846 	if (flag & ~AT_SYMLINK_NOFOLLOW)
2847 		return (EINVAL);
2848 
2849 	return (kern_fchmodat(td, fd, path, UIO_USERSPACE, mode, flag));
2850 }
2851 
2852 int
2853 kern_chmod(struct thread *td, char *path, enum uio_seg pathseg, int mode)
2854 {
2855 
2856 	return (kern_fchmodat(td, AT_FDCWD, path, pathseg, mode, 0));
2857 }
2858 
2859 /*
2860  * Change mode of a file given path name (don't follow links.)
2861  */
2862 #ifndef _SYS_SYSPROTO_H_
2863 struct lchmod_args {
2864 	char	*path;
2865 	int	mode;
2866 };
2867 #endif
2868 int
2869 sys_lchmod(td, uap)
2870 	struct thread *td;
2871 	register struct lchmod_args /* {
2872 		char *path;
2873 		int mode;
2874 	} */ *uap;
2875 {
2876 
2877 	return (kern_fchmodat(td, AT_FDCWD, uap->path, UIO_USERSPACE,
2878 	    uap->mode, AT_SYMLINK_NOFOLLOW));
2879 }
2880 
2881 int
2882 kern_fchmodat(struct thread *td, int fd, char *path, enum uio_seg pathseg,
2883     mode_t mode, int flag)
2884 {
2885 	int error;
2886 	struct nameidata nd;
2887 	int follow;
2888 
2889 	AUDIT_ARG_MODE(mode);
2890 	follow = (flag & AT_SYMLINK_NOFOLLOW) ? NOFOLLOW : FOLLOW;
2891 	NDINIT_ATRIGHTS(&nd, LOOKUP, follow | AUDITVNODE1, pathseg, path, fd,
2892 	    CAP_FCHMOD, td);
2893 	if ((error = namei(&nd)) != 0)
2894 		return (error);
2895 	NDFREE(&nd, NDF_ONLY_PNBUF);
2896 	error = setfmode(td, td->td_ucred, nd.ni_vp, mode);
2897 	vrele(nd.ni_vp);
2898 	return (error);
2899 }
2900 
2901 /*
2902  * Change mode of a file given a file descriptor.
2903  */
2904 #ifndef _SYS_SYSPROTO_H_
2905 struct fchmod_args {
2906 	int	fd;
2907 	int	mode;
2908 };
2909 #endif
2910 int
2911 sys_fchmod(struct thread *td, struct fchmod_args *uap)
2912 {
2913 	struct file *fp;
2914 	int error;
2915 
2916 	AUDIT_ARG_FD(uap->fd);
2917 	AUDIT_ARG_MODE(uap->mode);
2918 
2919 	error = fget(td, uap->fd, CAP_FCHMOD, &fp);
2920 	if (error != 0)
2921 		return (error);
2922 	error = fo_chmod(fp, uap->mode, td->td_ucred, td);
2923 	fdrop(fp, td);
2924 	return (error);
2925 }
2926 
2927 /*
2928  * Common implementation for chown(), lchown(), and fchown()
2929  */
2930 int
2931 setfown(td, cred, vp, uid, gid)
2932 	struct thread *td;
2933 	struct ucred *cred;
2934 	struct vnode *vp;
2935 	uid_t uid;
2936 	gid_t gid;
2937 {
2938 	int error;
2939 	struct mount *mp;
2940 	struct vattr vattr;
2941 
2942 	if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0)
2943 		return (error);
2944 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
2945 	VATTR_NULL(&vattr);
2946 	vattr.va_uid = uid;
2947 	vattr.va_gid = gid;
2948 #ifdef MAC
2949 	error = mac_vnode_check_setowner(cred, vp, vattr.va_uid,
2950 	    vattr.va_gid);
2951 	if (error == 0)
2952 #endif
2953 		error = VOP_SETATTR(vp, &vattr, cred);
2954 	VOP_UNLOCK(vp, 0);
2955 	vn_finished_write(mp);
2956 	return (error);
2957 }
2958 
2959 /*
2960  * Set ownership given a path name.
2961  */
2962 #ifndef _SYS_SYSPROTO_H_
2963 struct chown_args {
2964 	char	*path;
2965 	int	uid;
2966 	int	gid;
2967 };
2968 #endif
2969 int
2970 sys_chown(td, uap)
2971 	struct thread *td;
2972 	register struct chown_args /* {
2973 		char *path;
2974 		int uid;
2975 		int gid;
2976 	} */ *uap;
2977 {
2978 
2979 	return (kern_chown(td, uap->path, UIO_USERSPACE, uap->uid, uap->gid));
2980 }
2981 
2982 #ifndef _SYS_SYSPROTO_H_
2983 struct fchownat_args {
2984 	int fd;
2985 	const char * path;
2986 	uid_t uid;
2987 	gid_t gid;
2988 	int flag;
2989 };
2990 #endif
2991 int
2992 sys_fchownat(struct thread *td, struct fchownat_args *uap)
2993 {
2994 	int flag;
2995 
2996 	flag = uap->flag;
2997 	if (flag & ~AT_SYMLINK_NOFOLLOW)
2998 		return (EINVAL);
2999 
3000 	return (kern_fchownat(td, uap->fd, uap->path, UIO_USERSPACE, uap->uid,
3001 	    uap->gid, uap->flag));
3002 }
3003 
3004 int
3005 kern_chown(struct thread *td, char *path, enum uio_seg pathseg, int uid,
3006     int gid)
3007 {
3008 
3009 	return (kern_fchownat(td, AT_FDCWD, path, pathseg, uid, gid, 0));
3010 }
3011 
3012 int
3013 kern_fchownat(struct thread *td, int fd, char *path, enum uio_seg pathseg,
3014     int uid, int gid, int flag)
3015 {
3016 	struct nameidata nd;
3017 	int error, follow;
3018 
3019 	AUDIT_ARG_OWNER(uid, gid);
3020 	follow = (flag & AT_SYMLINK_NOFOLLOW) ? NOFOLLOW : FOLLOW;
3021 	NDINIT_ATRIGHTS(&nd, LOOKUP, follow | AUDITVNODE1, pathseg, path, fd,
3022 	    CAP_FCHOWN, td);
3023 
3024 	if ((error = namei(&nd)) != 0)
3025 		return (error);
3026 	NDFREE(&nd, NDF_ONLY_PNBUF);
3027 	error = setfown(td, td->td_ucred, nd.ni_vp, uid, gid);
3028 	vrele(nd.ni_vp);
3029 	return (error);
3030 }
3031 
3032 /*
3033  * Set ownership given a path name, do not cross symlinks.
3034  */
3035 #ifndef _SYS_SYSPROTO_H_
3036 struct lchown_args {
3037 	char	*path;
3038 	int	uid;
3039 	int	gid;
3040 };
3041 #endif
3042 int
3043 sys_lchown(td, uap)
3044 	struct thread *td;
3045 	register struct lchown_args /* {
3046 		char *path;
3047 		int uid;
3048 		int gid;
3049 	} */ *uap;
3050 {
3051 
3052 	return (kern_lchown(td, uap->path, UIO_USERSPACE, uap->uid, uap->gid));
3053 }
3054 
3055 int
3056 kern_lchown(struct thread *td, char *path, enum uio_seg pathseg, int uid,
3057     int gid)
3058 {
3059 
3060 	return (kern_fchownat(td, AT_FDCWD, path, pathseg, uid, gid,
3061 	    AT_SYMLINK_NOFOLLOW));
3062 }
3063 
3064 /*
3065  * Set ownership given a file descriptor.
3066  */
3067 #ifndef _SYS_SYSPROTO_H_
3068 struct fchown_args {
3069 	int	fd;
3070 	int	uid;
3071 	int	gid;
3072 };
3073 #endif
3074 int
3075 sys_fchown(td, uap)
3076 	struct thread *td;
3077 	register struct fchown_args /* {
3078 		int fd;
3079 		int uid;
3080 		int gid;
3081 	} */ *uap;
3082 {
3083 	struct file *fp;
3084 	int error;
3085 
3086 	AUDIT_ARG_FD(uap->fd);
3087 	AUDIT_ARG_OWNER(uap->uid, uap->gid);
3088 	error = fget(td, uap->fd, CAP_FCHOWN, &fp);
3089 	if (error != 0)
3090 		return (error);
3091 	error = fo_chown(fp, uap->uid, uap->gid, td->td_ucred, td);
3092 	fdrop(fp, td);
3093 	return (error);
3094 }
3095 
3096 /*
3097  * Common implementation code for utimes(), lutimes(), and futimes().
3098  */
3099 static int
3100 getutimes(usrtvp, tvpseg, tsp)
3101 	const struct timeval *usrtvp;
3102 	enum uio_seg tvpseg;
3103 	struct timespec *tsp;
3104 {
3105 	struct timeval tv[2];
3106 	const struct timeval *tvp;
3107 	int error;
3108 
3109 	if (usrtvp == NULL) {
3110 		vfs_timestamp(&tsp[0]);
3111 		tsp[1] = tsp[0];
3112 	} else {
3113 		if (tvpseg == UIO_SYSSPACE) {
3114 			tvp = usrtvp;
3115 		} else {
3116 			if ((error = copyin(usrtvp, tv, sizeof(tv))) != 0)
3117 				return (error);
3118 			tvp = tv;
3119 		}
3120 
3121 		if (tvp[0].tv_usec < 0 || tvp[0].tv_usec >= 1000000 ||
3122 		    tvp[1].tv_usec < 0 || tvp[1].tv_usec >= 1000000)
3123 			return (EINVAL);
3124 		TIMEVAL_TO_TIMESPEC(&tvp[0], &tsp[0]);
3125 		TIMEVAL_TO_TIMESPEC(&tvp[1], &tsp[1]);
3126 	}
3127 	return (0);
3128 }
3129 
3130 /*
3131  * Common implementation code for utimes(), lutimes(), and futimes().
3132  */
3133 static int
3134 setutimes(td, vp, ts, numtimes, nullflag)
3135 	struct thread *td;
3136 	struct vnode *vp;
3137 	const struct timespec *ts;
3138 	int numtimes;
3139 	int nullflag;
3140 {
3141 	int error, setbirthtime;
3142 	struct mount *mp;
3143 	struct vattr vattr;
3144 
3145 	if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0)
3146 		return (error);
3147 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
3148 	setbirthtime = 0;
3149 	if (numtimes < 3 && !VOP_GETATTR(vp, &vattr, td->td_ucred) &&
3150 	    timespeccmp(&ts[1], &vattr.va_birthtime, < ))
3151 		setbirthtime = 1;
3152 	VATTR_NULL(&vattr);
3153 	vattr.va_atime = ts[0];
3154 	vattr.va_mtime = ts[1];
3155 	if (setbirthtime)
3156 		vattr.va_birthtime = ts[1];
3157 	if (numtimes > 2)
3158 		vattr.va_birthtime = ts[2];
3159 	if (nullflag)
3160 		vattr.va_vaflags |= VA_UTIMES_NULL;
3161 #ifdef MAC
3162 	error = mac_vnode_check_setutimes(td->td_ucred, vp, vattr.va_atime,
3163 	    vattr.va_mtime);
3164 #endif
3165 	if (error == 0)
3166 		error = VOP_SETATTR(vp, &vattr, td->td_ucred);
3167 	VOP_UNLOCK(vp, 0);
3168 	vn_finished_write(mp);
3169 	return (error);
3170 }
3171 
3172 /*
3173  * Set the access and modification times of a file.
3174  */
3175 #ifndef _SYS_SYSPROTO_H_
3176 struct utimes_args {
3177 	char	*path;
3178 	struct	timeval *tptr;
3179 };
3180 #endif
3181 int
3182 sys_utimes(td, uap)
3183 	struct thread *td;
3184 	register struct utimes_args /* {
3185 		char *path;
3186 		struct timeval *tptr;
3187 	} */ *uap;
3188 {
3189 
3190 	return (kern_utimes(td, uap->path, UIO_USERSPACE, uap->tptr,
3191 	    UIO_USERSPACE));
3192 }
3193 
3194 #ifndef _SYS_SYSPROTO_H_
3195 struct futimesat_args {
3196 	int fd;
3197 	const char * path;
3198 	const struct timeval * times;
3199 };
3200 #endif
3201 int
3202 sys_futimesat(struct thread *td, struct futimesat_args *uap)
3203 {
3204 
3205 	return (kern_utimesat(td, uap->fd, uap->path, UIO_USERSPACE,
3206 	    uap->times, UIO_USERSPACE));
3207 }
3208 
3209 int
3210 kern_utimes(struct thread *td, char *path, enum uio_seg pathseg,
3211     struct timeval *tptr, enum uio_seg tptrseg)
3212 {
3213 
3214 	return (kern_utimesat(td, AT_FDCWD, path, pathseg, tptr, tptrseg));
3215 }
3216 
3217 int
3218 kern_utimesat(struct thread *td, int fd, char *path, enum uio_seg pathseg,
3219     struct timeval *tptr, enum uio_seg tptrseg)
3220 {
3221 	struct nameidata nd;
3222 	struct timespec ts[2];
3223 	int error;
3224 
3225 	if ((error = getutimes(tptr, tptrseg, ts)) != 0)
3226 		return (error);
3227 	NDINIT_ATRIGHTS(&nd, LOOKUP, FOLLOW | AUDITVNODE1, pathseg, path, fd,
3228 	    CAP_FUTIMES, td);
3229 
3230 	if ((error = namei(&nd)) != 0)
3231 		return (error);
3232 	NDFREE(&nd, NDF_ONLY_PNBUF);
3233 	error = setutimes(td, nd.ni_vp, ts, 2, tptr == NULL);
3234 	vrele(nd.ni_vp);
3235 	return (error);
3236 }
3237 
3238 /*
3239  * Set the access and modification times of a file.
3240  */
3241 #ifndef _SYS_SYSPROTO_H_
3242 struct lutimes_args {
3243 	char	*path;
3244 	struct	timeval *tptr;
3245 };
3246 #endif
3247 int
3248 sys_lutimes(td, uap)
3249 	struct thread *td;
3250 	register struct lutimes_args /* {
3251 		char *path;
3252 		struct timeval *tptr;
3253 	} */ *uap;
3254 {
3255 
3256 	return (kern_lutimes(td, uap->path, UIO_USERSPACE, uap->tptr,
3257 	    UIO_USERSPACE));
3258 }
3259 
3260 int
3261 kern_lutimes(struct thread *td, char *path, enum uio_seg pathseg,
3262     struct timeval *tptr, enum uio_seg tptrseg)
3263 {
3264 	struct timespec ts[2];
3265 	int error;
3266 	struct nameidata nd;
3267 
3268 	if ((error = getutimes(tptr, tptrseg, ts)) != 0)
3269 		return (error);
3270 	NDINIT(&nd, LOOKUP, NOFOLLOW | AUDITVNODE1, pathseg, path, td);
3271 	if ((error = namei(&nd)) != 0)
3272 		return (error);
3273 	NDFREE(&nd, NDF_ONLY_PNBUF);
3274 	error = setutimes(td, nd.ni_vp, ts, 2, tptr == NULL);
3275 	vrele(nd.ni_vp);
3276 	return (error);
3277 }
3278 
3279 /*
3280  * Set the access and modification times of a file.
3281  */
3282 #ifndef _SYS_SYSPROTO_H_
3283 struct futimes_args {
3284 	int	fd;
3285 	struct	timeval *tptr;
3286 };
3287 #endif
3288 int
3289 sys_futimes(td, uap)
3290 	struct thread *td;
3291 	register struct futimes_args /* {
3292 		int  fd;
3293 		struct timeval *tptr;
3294 	} */ *uap;
3295 {
3296 
3297 	return (kern_futimes(td, uap->fd, uap->tptr, UIO_USERSPACE));
3298 }
3299 
3300 int
3301 kern_futimes(struct thread *td, int fd, struct timeval *tptr,
3302     enum uio_seg tptrseg)
3303 {
3304 	struct timespec ts[2];
3305 	struct file *fp;
3306 	int error;
3307 
3308 	AUDIT_ARG_FD(fd);
3309 	if ((error = getutimes(tptr, tptrseg, ts)) != 0)
3310 		return (error);
3311 	if ((error = getvnode(td->td_proc->p_fd, fd, CAP_FUTIMES, &fp)) != 0)
3312 		return (error);
3313 #ifdef AUDIT
3314 	vn_lock(fp->f_vnode, LK_SHARED | LK_RETRY);
3315 	AUDIT_ARG_VNODE1(fp->f_vnode);
3316 	VOP_UNLOCK(fp->f_vnode, 0);
3317 #endif
3318 	error = setutimes(td, fp->f_vnode, ts, 2, tptr == NULL);
3319 	fdrop(fp, td);
3320 	return (error);
3321 }
3322 
3323 /*
3324  * Truncate a file given its path name.
3325  */
3326 #ifndef _SYS_SYSPROTO_H_
3327 struct truncate_args {
3328 	char	*path;
3329 	int	pad;
3330 	off_t	length;
3331 };
3332 #endif
3333 int
3334 sys_truncate(td, uap)
3335 	struct thread *td;
3336 	register struct truncate_args /* {
3337 		char *path;
3338 		int pad;
3339 		off_t length;
3340 	} */ *uap;
3341 {
3342 
3343 	return (kern_truncate(td, uap->path, UIO_USERSPACE, uap->length));
3344 }
3345 
3346 int
3347 kern_truncate(struct thread *td, char *path, enum uio_seg pathseg, off_t length)
3348 {
3349 	struct mount *mp;
3350 	struct vnode *vp;
3351 	void *rl_cookie;
3352 	struct vattr vattr;
3353 	struct nameidata nd;
3354 	int error;
3355 
3356 	if (length < 0)
3357 		return(EINVAL);
3358 	NDINIT(&nd, LOOKUP, FOLLOW | AUDITVNODE1, pathseg, path, td);
3359 	if ((error = namei(&nd)) != 0)
3360 		return (error);
3361 	vp = nd.ni_vp;
3362 	rl_cookie = vn_rangelock_wlock(vp, 0, OFF_MAX);
3363 	if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0) {
3364 		vn_rangelock_unlock(vp, rl_cookie);
3365 		vrele(vp);
3366 		return (error);
3367 	}
3368 	NDFREE(&nd, NDF_ONLY_PNBUF);
3369 	vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
3370 	if (vp->v_type == VDIR)
3371 		error = EISDIR;
3372 #ifdef MAC
3373 	else if ((error = mac_vnode_check_write(td->td_ucred, NOCRED, vp))) {
3374 	}
3375 #endif
3376 	else if ((error = vn_writechk(vp)) == 0 &&
3377 	    (error = VOP_ACCESS(vp, VWRITE, td->td_ucred, td)) == 0) {
3378 		VATTR_NULL(&vattr);
3379 		vattr.va_size = length;
3380 		error = VOP_SETATTR(vp, &vattr, td->td_ucred);
3381 	}
3382 	VOP_UNLOCK(vp, 0);
3383 	vn_finished_write(mp);
3384 	vn_rangelock_unlock(vp, rl_cookie);
3385 	vrele(vp);
3386 	return (error);
3387 }
3388 
3389 #if defined(COMPAT_43)
3390 /*
3391  * Truncate a file given its path name.
3392  */
3393 #ifndef _SYS_SYSPROTO_H_
3394 struct otruncate_args {
3395 	char	*path;
3396 	long	length;
3397 };
3398 #endif
3399 int
3400 otruncate(td, uap)
3401 	struct thread *td;
3402 	register struct otruncate_args /* {
3403 		char *path;
3404 		long length;
3405 	} */ *uap;
3406 {
3407 	struct truncate_args /* {
3408 		char *path;
3409 		int pad;
3410 		off_t length;
3411 	} */ nuap;
3412 
3413 	nuap.path = uap->path;
3414 	nuap.length = uap->length;
3415 	return (sys_truncate(td, &nuap));
3416 }
3417 #endif /* COMPAT_43 */
3418 
3419 /* Versions with the pad argument */
3420 int
3421 freebsd6_truncate(struct thread *td, struct freebsd6_truncate_args *uap)
3422 {
3423 	struct truncate_args ouap;
3424 
3425 	ouap.path = uap->path;
3426 	ouap.length = uap->length;
3427 	return (sys_truncate(td, &ouap));
3428 }
3429 
3430 int
3431 freebsd6_ftruncate(struct thread *td, struct freebsd6_ftruncate_args *uap)
3432 {
3433 	struct ftruncate_args ouap;
3434 
3435 	ouap.fd = uap->fd;
3436 	ouap.length = uap->length;
3437 	return (sys_ftruncate(td, &ouap));
3438 }
3439 
3440 /*
3441  * Sync an open file.
3442  */
3443 #ifndef _SYS_SYSPROTO_H_
3444 struct fsync_args {
3445 	int	fd;
3446 };
3447 #endif
3448 int
3449 sys_fsync(td, uap)
3450 	struct thread *td;
3451 	struct fsync_args /* {
3452 		int fd;
3453 	} */ *uap;
3454 {
3455 	struct vnode *vp;
3456 	struct mount *mp;
3457 	struct file *fp;
3458 	int error, lock_flags;
3459 
3460 	AUDIT_ARG_FD(uap->fd);
3461 	if ((error = getvnode(td->td_proc->p_fd, uap->fd, CAP_FSYNC, &fp)) != 0)
3462 		return (error);
3463 	vp = fp->f_vnode;
3464 	if ((error = vn_start_write(vp, &mp, V_WAIT | PCATCH)) != 0)
3465 		goto drop;
3466 	if (MNT_SHARED_WRITES(mp) ||
3467 	    ((mp == NULL) && MNT_SHARED_WRITES(vp->v_mount))) {
3468 		lock_flags = LK_SHARED;
3469 	} else {
3470 		lock_flags = LK_EXCLUSIVE;
3471 	}
3472 	vn_lock(vp, lock_flags | LK_RETRY);
3473 	AUDIT_ARG_VNODE1(vp);
3474 	if (vp->v_object != NULL) {
3475 		VM_OBJECT_WLOCK(vp->v_object);
3476 		vm_object_page_clean(vp->v_object, 0, 0, 0);
3477 		VM_OBJECT_WUNLOCK(vp->v_object);
3478 	}
3479 	error = VOP_FSYNC(vp, MNT_WAIT, td);
3480 
3481 	VOP_UNLOCK(vp, 0);
3482 	vn_finished_write(mp);
3483 drop:
3484 	fdrop(fp, td);
3485 	return (error);
3486 }
3487 
3488 /*
3489  * Rename files.  Source and destination must either both be directories, or
3490  * both not be directories.  If target is a directory, it must be empty.
3491  */
3492 #ifndef _SYS_SYSPROTO_H_
3493 struct rename_args {
3494 	char	*from;
3495 	char	*to;
3496 };
3497 #endif
3498 int
3499 sys_rename(td, uap)
3500 	struct thread *td;
3501 	register struct rename_args /* {
3502 		char *from;
3503 		char *to;
3504 	} */ *uap;
3505 {
3506 
3507 	return (kern_rename(td, uap->from, uap->to, UIO_USERSPACE));
3508 }
3509 
3510 #ifndef _SYS_SYSPROTO_H_
3511 struct renameat_args {
3512 	int	oldfd;
3513 	char	*old;
3514 	int	newfd;
3515 	char	*new;
3516 };
3517 #endif
3518 int
3519 sys_renameat(struct thread *td, struct renameat_args *uap)
3520 {
3521 
3522 	return (kern_renameat(td, uap->oldfd, uap->old, uap->newfd, uap->new,
3523 	    UIO_USERSPACE));
3524 }
3525 
3526 int
3527 kern_rename(struct thread *td, char *from, char *to, enum uio_seg pathseg)
3528 {
3529 
3530 	return (kern_renameat(td, AT_FDCWD, from, AT_FDCWD, to, pathseg));
3531 }
3532 
3533 int
3534 kern_renameat(struct thread *td, int oldfd, char *old, int newfd, char *new,
3535     enum uio_seg pathseg)
3536 {
3537 	struct mount *mp = NULL;
3538 	struct vnode *tvp, *fvp, *tdvp;
3539 	struct nameidata fromnd, tond;
3540 	int error;
3541 
3542 	bwillwrite();
3543 #ifdef MAC
3544 	NDINIT_ATRIGHTS(&fromnd, DELETE, LOCKPARENT | LOCKLEAF | SAVESTART |
3545 	    AUDITVNODE1, pathseg, old, oldfd, CAP_RENAMEAT, td);
3546 #else
3547 	NDINIT_ATRIGHTS(&fromnd, DELETE, WANTPARENT | SAVESTART | AUDITVNODE1,
3548 	    pathseg, old, oldfd, CAP_RENAMEAT, td);
3549 #endif
3550 
3551 	if ((error = namei(&fromnd)) != 0)
3552 		return (error);
3553 #ifdef MAC
3554 	error = mac_vnode_check_rename_from(td->td_ucred, fromnd.ni_dvp,
3555 	    fromnd.ni_vp, &fromnd.ni_cnd);
3556 	VOP_UNLOCK(fromnd.ni_dvp, 0);
3557 	if (fromnd.ni_dvp != fromnd.ni_vp)
3558 		VOP_UNLOCK(fromnd.ni_vp, 0);
3559 #endif
3560 	fvp = fromnd.ni_vp;
3561 	if (error == 0)
3562 		error = vn_start_write(fvp, &mp, V_WAIT | PCATCH);
3563 	if (error != 0) {
3564 		NDFREE(&fromnd, NDF_ONLY_PNBUF);
3565 		vrele(fromnd.ni_dvp);
3566 		vrele(fvp);
3567 		goto out1;
3568 	}
3569 	NDINIT_ATRIGHTS(&tond, RENAME, LOCKPARENT | LOCKLEAF | NOCACHE |
3570 	    SAVESTART | AUDITVNODE2, pathseg, new, newfd, CAP_LINKAT, td);
3571 	if (fromnd.ni_vp->v_type == VDIR)
3572 		tond.ni_cnd.cn_flags |= WILLBEDIR;
3573 	if ((error = namei(&tond)) != 0) {
3574 		/* Translate error code for rename("dir1", "dir2/."). */
3575 		if (error == EISDIR && fvp->v_type == VDIR)
3576 			error = EINVAL;
3577 		NDFREE(&fromnd, NDF_ONLY_PNBUF);
3578 		vrele(fromnd.ni_dvp);
3579 		vrele(fvp);
3580 		vn_finished_write(mp);
3581 		goto out1;
3582 	}
3583 	tdvp = tond.ni_dvp;
3584 	tvp = tond.ni_vp;
3585 	if (tvp != NULL) {
3586 		if (fvp->v_type == VDIR && tvp->v_type != VDIR) {
3587 			error = ENOTDIR;
3588 			goto out;
3589 		} else if (fvp->v_type != VDIR && tvp->v_type == VDIR) {
3590 			error = EISDIR;
3591 			goto out;
3592 		}
3593 #ifdef CAPABILITIES
3594 		if (newfd != AT_FDCWD) {
3595 			/*
3596 			 * If the target already exists we require CAP_UNLINKAT
3597 			 * from 'newfd'.
3598 			 */
3599 			error = cap_check(tond.ni_filecaps.fc_rights,
3600 			    CAP_UNLINKAT);
3601 			if (error != 0)
3602 				goto out;
3603 		}
3604 #endif
3605 	}
3606 	if (fvp == tdvp) {
3607 		error = EINVAL;
3608 		goto out;
3609 	}
3610 	/*
3611 	 * If the source is the same as the destination (that is, if they
3612 	 * are links to the same vnode), then there is nothing to do.
3613 	 */
3614 	if (fvp == tvp)
3615 		error = -1;
3616 #ifdef MAC
3617 	else
3618 		error = mac_vnode_check_rename_to(td->td_ucred, tdvp,
3619 		    tond.ni_vp, fromnd.ni_dvp == tdvp, &tond.ni_cnd);
3620 #endif
3621 out:
3622 	if (!error) {
3623 		error = VOP_RENAME(fromnd.ni_dvp, fromnd.ni_vp, &fromnd.ni_cnd,
3624 				   tond.ni_dvp, tond.ni_vp, &tond.ni_cnd);
3625 		NDFREE(&fromnd, NDF_ONLY_PNBUF);
3626 		NDFREE(&tond, NDF_ONLY_PNBUF);
3627 	} else {
3628 		NDFREE(&fromnd, NDF_ONLY_PNBUF);
3629 		NDFREE(&tond, NDF_ONLY_PNBUF);
3630 		if (tvp)
3631 			vput(tvp);
3632 		if (tdvp == tvp)
3633 			vrele(tdvp);
3634 		else
3635 			vput(tdvp);
3636 		vrele(fromnd.ni_dvp);
3637 		vrele(fvp);
3638 	}
3639 	vrele(tond.ni_startdir);
3640 	vn_finished_write(mp);
3641 out1:
3642 	if (fromnd.ni_startdir)
3643 		vrele(fromnd.ni_startdir);
3644 	if (error == -1)
3645 		return (0);
3646 	return (error);
3647 }
3648 
3649 /*
3650  * Make a directory file.
3651  */
3652 #ifndef _SYS_SYSPROTO_H_
3653 struct mkdir_args {
3654 	char	*path;
3655 	int	mode;
3656 };
3657 #endif
3658 int
3659 sys_mkdir(td, uap)
3660 	struct thread *td;
3661 	register struct mkdir_args /* {
3662 		char *path;
3663 		int mode;
3664 	} */ *uap;
3665 {
3666 
3667 	return (kern_mkdir(td, uap->path, UIO_USERSPACE, uap->mode));
3668 }
3669 
3670 #ifndef _SYS_SYSPROTO_H_
3671 struct mkdirat_args {
3672 	int	fd;
3673 	char	*path;
3674 	mode_t	mode;
3675 };
3676 #endif
3677 int
3678 sys_mkdirat(struct thread *td, struct mkdirat_args *uap)
3679 {
3680 
3681 	return (kern_mkdirat(td, uap->fd, uap->path, UIO_USERSPACE, uap->mode));
3682 }
3683 
3684 int
3685 kern_mkdir(struct thread *td, char *path, enum uio_seg segflg, int mode)
3686 {
3687 
3688 	return (kern_mkdirat(td, AT_FDCWD, path, segflg, mode));
3689 }
3690 
3691 int
3692 kern_mkdirat(struct thread *td, int fd, char *path, enum uio_seg segflg,
3693     int mode)
3694 {
3695 	struct mount *mp;
3696 	struct vnode *vp;
3697 	struct vattr vattr;
3698 	int error;
3699 	struct nameidata nd;
3700 
3701 	AUDIT_ARG_MODE(mode);
3702 restart:
3703 	bwillwrite();
3704 	NDINIT_ATRIGHTS(&nd, CREATE, LOCKPARENT | SAVENAME | AUDITVNODE1,
3705 	    segflg, path, fd, CAP_MKDIRAT, td);
3706 	nd.ni_cnd.cn_flags |= WILLBEDIR;
3707 	if ((error = namei(&nd)) != 0)
3708 		return (error);
3709 	vp = nd.ni_vp;
3710 	if (vp != NULL) {
3711 		NDFREE(&nd, NDF_ONLY_PNBUF);
3712 		/*
3713 		 * XXX namei called with LOCKPARENT but not LOCKLEAF has
3714 		 * the strange behaviour of leaving the vnode unlocked
3715 		 * if the target is the same vnode as the parent.
3716 		 */
3717 		if (vp == nd.ni_dvp)
3718 			vrele(nd.ni_dvp);
3719 		else
3720 			vput(nd.ni_dvp);
3721 		vrele(vp);
3722 		return (EEXIST);
3723 	}
3724 	if (vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) {
3725 		NDFREE(&nd, NDF_ONLY_PNBUF);
3726 		vput(nd.ni_dvp);
3727 		if ((error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH)) != 0)
3728 			return (error);
3729 		goto restart;
3730 	}
3731 	VATTR_NULL(&vattr);
3732 	vattr.va_type = VDIR;
3733 	vattr.va_mode = (mode & ACCESSPERMS) &~ td->td_proc->p_fd->fd_cmask;
3734 #ifdef MAC
3735 	error = mac_vnode_check_create(td->td_ucred, nd.ni_dvp, &nd.ni_cnd,
3736 	    &vattr);
3737 	if (error)
3738 		goto out;
3739 #endif
3740 	error = VOP_MKDIR(nd.ni_dvp, &nd.ni_vp, &nd.ni_cnd, &vattr);
3741 #ifdef MAC
3742 out:
3743 #endif
3744 	NDFREE(&nd, NDF_ONLY_PNBUF);
3745 	vput(nd.ni_dvp);
3746 	if (!error)
3747 		vput(nd.ni_vp);
3748 	vn_finished_write(mp);
3749 	return (error);
3750 }
3751 
3752 /*
3753  * Remove a directory file.
3754  */
3755 #ifndef _SYS_SYSPROTO_H_
3756 struct rmdir_args {
3757 	char	*path;
3758 };
3759 #endif
3760 int
3761 sys_rmdir(td, uap)
3762 	struct thread *td;
3763 	struct rmdir_args /* {
3764 		char *path;
3765 	} */ *uap;
3766 {
3767 
3768 	return (kern_rmdir(td, uap->path, UIO_USERSPACE));
3769 }
3770 
3771 int
3772 kern_rmdir(struct thread *td, char *path, enum uio_seg pathseg)
3773 {
3774 
3775 	return (kern_rmdirat(td, AT_FDCWD, path, pathseg));
3776 }
3777 
3778 int
3779 kern_rmdirat(struct thread *td, int fd, char *path, enum uio_seg pathseg)
3780 {
3781 	struct mount *mp;
3782 	struct vnode *vp;
3783 	int error;
3784 	struct nameidata nd;
3785 
3786 restart:
3787 	bwillwrite();
3788 	NDINIT_ATRIGHTS(&nd, DELETE, LOCKPARENT | LOCKLEAF | AUDITVNODE1,
3789 	    pathseg, path, fd, CAP_UNLINKAT, td);
3790 	if ((error = namei(&nd)) != 0)
3791 		return (error);
3792 	vp = nd.ni_vp;
3793 	if (vp->v_type != VDIR) {
3794 		error = ENOTDIR;
3795 		goto out;
3796 	}
3797 	/*
3798 	 * No rmdir "." please.
3799 	 */
3800 	if (nd.ni_dvp == vp) {
3801 		error = EINVAL;
3802 		goto out;
3803 	}
3804 	/*
3805 	 * The root of a mounted filesystem cannot be deleted.
3806 	 */
3807 	if (vp->v_vflag & VV_ROOT) {
3808 		error = EBUSY;
3809 		goto out;
3810 	}
3811 #ifdef MAC
3812 	error = mac_vnode_check_unlink(td->td_ucred, nd.ni_dvp, vp,
3813 	    &nd.ni_cnd);
3814 	if (error)
3815 		goto out;
3816 #endif
3817 	if (vn_start_write(nd.ni_dvp, &mp, V_NOWAIT) != 0) {
3818 		NDFREE(&nd, NDF_ONLY_PNBUF);
3819 		vput(vp);
3820 		if (nd.ni_dvp == vp)
3821 			vrele(nd.ni_dvp);
3822 		else
3823 			vput(nd.ni_dvp);
3824 		if ((error = vn_start_write(NULL, &mp, V_XSLEEP | PCATCH)) != 0)
3825 			return (error);
3826 		goto restart;
3827 	}
3828 	error = VOP_RMDIR(nd.ni_dvp, nd.ni_vp, &nd.ni_cnd);
3829 	vn_finished_write(mp);
3830 out:
3831 	NDFREE(&nd, NDF_ONLY_PNBUF);
3832 	vput(vp);
3833 	if (nd.ni_dvp == vp)
3834 		vrele(nd.ni_dvp);
3835 	else
3836 		vput(nd.ni_dvp);
3837 	return (error);
3838 }
3839 
3840 #ifdef COMPAT_43
3841 /*
3842  * Read a block of directory entries in a filesystem independent format.
3843  */
3844 #ifndef _SYS_SYSPROTO_H_
3845 struct ogetdirentries_args {
3846 	int	fd;
3847 	char	*buf;
3848 	u_int	count;
3849 	long	*basep;
3850 };
3851 #endif
3852 int
3853 ogetdirentries(struct thread *td, struct ogetdirentries_args *uap)
3854 {
3855 	long loff;
3856 	int error;
3857 
3858 	error = kern_ogetdirentries(td, uap, &loff);
3859 	if (error == 0)
3860 		error = copyout(&loff, uap->basep, sizeof(long));
3861 	return (error);
3862 }
3863 
3864 int
3865 kern_ogetdirentries(struct thread *td, struct ogetdirentries_args *uap,
3866     long *ploff)
3867 {
3868 	struct vnode *vp;
3869 	struct file *fp;
3870 	struct uio auio, kuio;
3871 	struct iovec aiov, kiov;
3872 	struct dirent *dp, *edp;
3873 	caddr_t dirbuf;
3874 	int error, eofflag, readcnt;
3875 	long loff;
3876 	off_t foffset;
3877 
3878 	/* XXX arbitrary sanity limit on `count'. */
3879 	if (uap->count > 64 * 1024)
3880 		return (EINVAL);
3881 	if ((error = getvnode(td->td_proc->p_fd, uap->fd, CAP_READ, &fp)) != 0)
3882 		return (error);
3883 	if ((fp->f_flag & FREAD) == 0) {
3884 		fdrop(fp, td);
3885 		return (EBADF);
3886 	}
3887 	vp = fp->f_vnode;
3888 	foffset = foffset_lock(fp, 0);
3889 unionread:
3890 	if (vp->v_type != VDIR) {
3891 		foffset_unlock(fp, foffset, 0);
3892 		fdrop(fp, td);
3893 		return (EINVAL);
3894 	}
3895 	aiov.iov_base = uap->buf;
3896 	aiov.iov_len = uap->count;
3897 	auio.uio_iov = &aiov;
3898 	auio.uio_iovcnt = 1;
3899 	auio.uio_rw = UIO_READ;
3900 	auio.uio_segflg = UIO_USERSPACE;
3901 	auio.uio_td = td;
3902 	auio.uio_resid = uap->count;
3903 	vn_lock(vp, LK_SHARED | LK_RETRY);
3904 	loff = auio.uio_offset = foffset;
3905 #ifdef MAC
3906 	error = mac_vnode_check_readdir(td->td_ucred, vp);
3907 	if (error) {
3908 		VOP_UNLOCK(vp, 0);
3909 		foffset_unlock(fp, foffset, FOF_NOUPDATE);
3910 		fdrop(fp, td);
3911 		return (error);
3912 	}
3913 #endif
3914 #	if (BYTE_ORDER != LITTLE_ENDIAN)
3915 		if (vp->v_mount->mnt_maxsymlinklen <= 0) {
3916 			error = VOP_READDIR(vp, &auio, fp->f_cred, &eofflag,
3917 			    NULL, NULL);
3918 			foffset = auio.uio_offset;
3919 		} else
3920 #	endif
3921 	{
3922 		kuio = auio;
3923 		kuio.uio_iov = &kiov;
3924 		kuio.uio_segflg = UIO_SYSSPACE;
3925 		kiov.iov_len = uap->count;
3926 		dirbuf = malloc(uap->count, M_TEMP, M_WAITOK);
3927 		kiov.iov_base = dirbuf;
3928 		error = VOP_READDIR(vp, &kuio, fp->f_cred, &eofflag,
3929 			    NULL, NULL);
3930 		foffset = kuio.uio_offset;
3931 		if (error == 0) {
3932 			readcnt = uap->count - kuio.uio_resid;
3933 			edp = (struct dirent *)&dirbuf[readcnt];
3934 			for (dp = (struct dirent *)dirbuf; dp < edp; ) {
3935 #				if (BYTE_ORDER == LITTLE_ENDIAN)
3936 					/*
3937 					 * The expected low byte of
3938 					 * dp->d_namlen is our dp->d_type.
3939 					 * The high MBZ byte of dp->d_namlen
3940 					 * is our dp->d_namlen.
3941 					 */
3942 					dp->d_type = dp->d_namlen;
3943 					dp->d_namlen = 0;
3944 #				else
3945 					/*
3946 					 * The dp->d_type is the high byte
3947 					 * of the expected dp->d_namlen,
3948 					 * so must be zero'ed.
3949 					 */
3950 					dp->d_type = 0;
3951 #				endif
3952 				if (dp->d_reclen > 0) {
3953 					dp = (struct dirent *)
3954 					    ((char *)dp + dp->d_reclen);
3955 				} else {
3956 					error = EIO;
3957 					break;
3958 				}
3959 			}
3960 			if (dp >= edp)
3961 				error = uiomove(dirbuf, readcnt, &auio);
3962 		}
3963 		free(dirbuf, M_TEMP);
3964 	}
3965 	if (error) {
3966 		VOP_UNLOCK(vp, 0);
3967 		foffset_unlock(fp, foffset, 0);
3968 		fdrop(fp, td);
3969 		return (error);
3970 	}
3971 	if (uap->count == auio.uio_resid &&
3972 	    (vp->v_vflag & VV_ROOT) &&
3973 	    (vp->v_mount->mnt_flag & MNT_UNION)) {
3974 		struct vnode *tvp = vp;
3975 		vp = vp->v_mount->mnt_vnodecovered;
3976 		VREF(vp);
3977 		fp->f_vnode = vp;
3978 		fp->f_data = vp;
3979 		foffset = 0;
3980 		vput(tvp);
3981 		goto unionread;
3982 	}
3983 	VOP_UNLOCK(vp, 0);
3984 	foffset_unlock(fp, foffset, 0);
3985 	fdrop(fp, td);
3986 	td->td_retval[0] = uap->count - auio.uio_resid;
3987 	if (error == 0)
3988 		*ploff = loff;
3989 	return (error);
3990 }
3991 #endif /* COMPAT_43 */
3992 
3993 /*
3994  * Read a block of directory entries in a filesystem independent format.
3995  */
3996 #ifndef _SYS_SYSPROTO_H_
3997 struct getdirentries_args {
3998 	int	fd;
3999 	char	*buf;
4000 	u_int	count;
4001 	long	*basep;
4002 };
4003 #endif
4004 int
4005 sys_getdirentries(td, uap)
4006 	struct thread *td;
4007 	register struct getdirentries_args /* {
4008 		int fd;
4009 		char *buf;
4010 		u_int count;
4011 		long *basep;
4012 	} */ *uap;
4013 {
4014 	long base;
4015 	int error;
4016 
4017 	error = kern_getdirentries(td, uap->fd, uap->buf, uap->count, &base,
4018 	    NULL, UIO_USERSPACE);
4019 	if (error)
4020 		return (error);
4021 	if (uap->basep != NULL)
4022 		error = copyout(&base, uap->basep, sizeof(long));
4023 	return (error);
4024 }
4025 
4026 int
4027 kern_getdirentries(struct thread *td, int fd, char *buf, u_int count,
4028     long *basep, ssize_t *residp, enum uio_seg bufseg)
4029 {
4030 	struct vnode *vp;
4031 	struct file *fp;
4032 	struct uio auio;
4033 	struct iovec aiov;
4034 	long loff;
4035 	int error, eofflag;
4036 	off_t foffset;
4037 
4038 	AUDIT_ARG_FD(fd);
4039 	if (count > IOSIZE_MAX)
4040 		return (EINVAL);
4041 	auio.uio_resid = count;
4042 	if ((error = getvnode(td->td_proc->p_fd, fd, CAP_READ, &fp)) != 0)
4043 		return (error);
4044 	if ((fp->f_flag & FREAD) == 0) {
4045 		fdrop(fp, td);
4046 		return (EBADF);
4047 	}
4048 	vp = fp->f_vnode;
4049 	foffset = foffset_lock(fp, 0);
4050 unionread:
4051 	if (vp->v_type != VDIR) {
4052 		error = EINVAL;
4053 		goto fail;
4054 	}
4055 	aiov.iov_base = buf;
4056 	aiov.iov_len = count;
4057 	auio.uio_iov = &aiov;
4058 	auio.uio_iovcnt = 1;
4059 	auio.uio_rw = UIO_READ;
4060 	auio.uio_segflg = bufseg;
4061 	auio.uio_td = td;
4062 	vn_lock(vp, LK_SHARED | LK_RETRY);
4063 	AUDIT_ARG_VNODE1(vp);
4064 	loff = auio.uio_offset = foffset;
4065 #ifdef MAC
4066 	error = mac_vnode_check_readdir(td->td_ucred, vp);
4067 	if (error == 0)
4068 #endif
4069 		error = VOP_READDIR(vp, &auio, fp->f_cred, &eofflag, NULL,
4070 		    NULL);
4071 	foffset = auio.uio_offset;
4072 	if (error) {
4073 		VOP_UNLOCK(vp, 0);
4074 		goto fail;
4075 	}
4076 	if (count == auio.uio_resid &&
4077 	    (vp->v_vflag & VV_ROOT) &&
4078 	    (vp->v_mount->mnt_flag & MNT_UNION)) {
4079 		struct vnode *tvp = vp;
4080 		vp = vp->v_mount->mnt_vnodecovered;
4081 		VREF(vp);
4082 		fp->f_vnode = vp;
4083 		fp->f_data = vp;
4084 		foffset = 0;
4085 		vput(tvp);
4086 		goto unionread;
4087 	}
4088 	VOP_UNLOCK(vp, 0);
4089 	*basep = loff;
4090 	if (residp != NULL)
4091 		*residp = auio.uio_resid;
4092 	td->td_retval[0] = count - auio.uio_resid;
4093 fail:
4094 	foffset_unlock(fp, foffset, 0);
4095 	fdrop(fp, td);
4096 	return (error);
4097 }
4098 
4099 #ifndef _SYS_SYSPROTO_H_
4100 struct getdents_args {
4101 	int fd;
4102 	char *buf;
4103 	size_t count;
4104 };
4105 #endif
4106 int
4107 sys_getdents(td, uap)
4108 	struct thread *td;
4109 	register struct getdents_args /* {
4110 		int fd;
4111 		char *buf;
4112 		u_int count;
4113 	} */ *uap;
4114 {
4115 	struct getdirentries_args ap;
4116 	ap.fd = uap->fd;
4117 	ap.buf = uap->buf;
4118 	ap.count = uap->count;
4119 	ap.basep = NULL;
4120 	return (sys_getdirentries(td, &ap));
4121 }
4122 
4123 /*
4124  * Set the mode mask for creation of filesystem nodes.
4125  */
4126 #ifndef _SYS_SYSPROTO_H_
4127 struct umask_args {
4128 	int	newmask;
4129 };
4130 #endif
4131 int
4132 sys_umask(td, uap)
4133 	struct thread *td;
4134 	struct umask_args /* {
4135 		int newmask;
4136 	} */ *uap;
4137 {
4138 	register struct filedesc *fdp;
4139 
4140 	FILEDESC_XLOCK(td->td_proc->p_fd);
4141 	fdp = td->td_proc->p_fd;
4142 	td->td_retval[0] = fdp->fd_cmask;
4143 	fdp->fd_cmask = uap->newmask & ALLPERMS;
4144 	FILEDESC_XUNLOCK(td->td_proc->p_fd);
4145 	return (0);
4146 }
4147 
4148 /*
4149  * Void all references to file by ripping underlying filesystem away from
4150  * vnode.
4151  */
4152 #ifndef _SYS_SYSPROTO_H_
4153 struct revoke_args {
4154 	char	*path;
4155 };
4156 #endif
4157 int
4158 sys_revoke(td, uap)
4159 	struct thread *td;
4160 	register struct revoke_args /* {
4161 		char *path;
4162 	} */ *uap;
4163 {
4164 	struct vnode *vp;
4165 	struct vattr vattr;
4166 	int error;
4167 	struct nameidata nd;
4168 
4169 	NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | AUDITVNODE1, UIO_USERSPACE,
4170 	    uap->path, td);
4171 	if ((error = namei(&nd)) != 0)
4172 		return (error);
4173 	vp = nd.ni_vp;
4174 	NDFREE(&nd, NDF_ONLY_PNBUF);
4175 	if (vp->v_type != VCHR || vp->v_rdev == NULL) {
4176 		error = EINVAL;
4177 		goto out;
4178 	}
4179 #ifdef MAC
4180 	error = mac_vnode_check_revoke(td->td_ucred, vp);
4181 	if (error)
4182 		goto out;
4183 #endif
4184 	error = VOP_GETATTR(vp, &vattr, td->td_ucred);
4185 	if (error)
4186 		goto out;
4187 	if (td->td_ucred->cr_uid != vattr.va_uid) {
4188 		error = priv_check(td, PRIV_VFS_ADMIN);
4189 		if (error)
4190 			goto out;
4191 	}
4192 	if (vcount(vp) > 1)
4193 		VOP_REVOKE(vp, REVOKEALL);
4194 out:
4195 	vput(vp);
4196 	return (error);
4197 }
4198 
4199 /*
4200  * Convert a user file descriptor to a kernel file entry and check that, if it
4201  * is a capability, the correct rights are present. A reference on the file
4202  * entry is held upon returning.
4203  */
4204 int
4205 getvnode(struct filedesc *fdp, int fd, cap_rights_t rights, struct file **fpp)
4206 {
4207 	struct file *fp;
4208 	int error;
4209 
4210 	error = fget_unlocked(fdp, fd, rights, 0, &fp, NULL);
4211 	if (error != 0)
4212 		return (error);
4213 
4214 	/*
4215 	 * The file could be not of the vnode type, or it may be not
4216 	 * yet fully initialized, in which case the f_vnode pointer
4217 	 * may be set, but f_ops is still badfileops.  E.g.,
4218 	 * devfs_open() transiently create such situation to
4219 	 * facilitate csw d_fdopen().
4220 	 *
4221 	 * Dupfdopen() handling in kern_openat() installs the
4222 	 * half-baked file into the process descriptor table, allowing
4223 	 * other thread to dereference it. Guard against the race by
4224 	 * checking f_ops.
4225 	 */
4226 	if (fp->f_vnode == NULL || fp->f_ops == &badfileops) {
4227 		fdrop(fp, curthread);
4228 		return (EINVAL);
4229 	}
4230 	*fpp = fp;
4231 	return (0);
4232 }
4233 
4234 
4235 /*
4236  * Get an (NFS) file handle.
4237  */
4238 #ifndef _SYS_SYSPROTO_H_
4239 struct lgetfh_args {
4240 	char	*fname;
4241 	fhandle_t *fhp;
4242 };
4243 #endif
4244 int
4245 sys_lgetfh(td, uap)
4246 	struct thread *td;
4247 	register struct lgetfh_args *uap;
4248 {
4249 	struct nameidata nd;
4250 	fhandle_t fh;
4251 	register struct vnode *vp;
4252 	int error;
4253 
4254 	error = priv_check(td, PRIV_VFS_GETFH);
4255 	if (error)
4256 		return (error);
4257 	NDINIT(&nd, LOOKUP, NOFOLLOW | LOCKLEAF | AUDITVNODE1, UIO_USERSPACE,
4258 	    uap->fname, td);
4259 	error = namei(&nd);
4260 	if (error)
4261 		return (error);
4262 	NDFREE(&nd, NDF_ONLY_PNBUF);
4263 	vp = nd.ni_vp;
4264 	bzero(&fh, sizeof(fh));
4265 	fh.fh_fsid = vp->v_mount->mnt_stat.f_fsid;
4266 	error = VOP_VPTOFH(vp, &fh.fh_fid);
4267 	vput(vp);
4268 	if (error)
4269 		return (error);
4270 	error = copyout(&fh, uap->fhp, sizeof (fh));
4271 	return (error);
4272 }
4273 
4274 #ifndef _SYS_SYSPROTO_H_
4275 struct getfh_args {
4276 	char	*fname;
4277 	fhandle_t *fhp;
4278 };
4279 #endif
4280 int
4281 sys_getfh(td, uap)
4282 	struct thread *td;
4283 	register struct getfh_args *uap;
4284 {
4285 	struct nameidata nd;
4286 	fhandle_t fh;
4287 	register struct vnode *vp;
4288 	int error;
4289 
4290 	error = priv_check(td, PRIV_VFS_GETFH);
4291 	if (error)
4292 		return (error);
4293 	NDINIT(&nd, LOOKUP, FOLLOW | LOCKLEAF | AUDITVNODE1, UIO_USERSPACE,
4294 	    uap->fname, td);
4295 	error = namei(&nd);
4296 	if (error)
4297 		return (error);
4298 	NDFREE(&nd, NDF_ONLY_PNBUF);
4299 	vp = nd.ni_vp;
4300 	bzero(&fh, sizeof(fh));
4301 	fh.fh_fsid = vp->v_mount->mnt_stat.f_fsid;
4302 	error = VOP_VPTOFH(vp, &fh.fh_fid);
4303 	vput(vp);
4304 	if (error)
4305 		return (error);
4306 	error = copyout(&fh, uap->fhp, sizeof (fh));
4307 	return (error);
4308 }
4309 
4310 /*
4311  * syscall for the rpc.lockd to use to translate a NFS file handle into an
4312  * open descriptor.
4313  *
4314  * warning: do not remove the priv_check() call or this becomes one giant
4315  * security hole.
4316  */
4317 #ifndef _SYS_SYSPROTO_H_
4318 struct fhopen_args {
4319 	const struct fhandle *u_fhp;
4320 	int flags;
4321 };
4322 #endif
4323 int
4324 sys_fhopen(td, uap)
4325 	struct thread *td;
4326 	struct fhopen_args /* {
4327 		const struct fhandle *u_fhp;
4328 		int flags;
4329 	} */ *uap;
4330 {
4331 	struct mount *mp;
4332 	struct vnode *vp;
4333 	struct fhandle fhp;
4334 	struct file *fp;
4335 	int fmode, error;
4336 	int indx;
4337 
4338 	error = priv_check(td, PRIV_VFS_FHOPEN);
4339 	if (error)
4340 		return (error);
4341 	indx = -1;
4342 	fmode = FFLAGS(uap->flags);
4343 	/* why not allow a non-read/write open for our lockd? */
4344 	if (((fmode & (FREAD | FWRITE)) == 0) || (fmode & O_CREAT))
4345 		return (EINVAL);
4346 	error = copyin(uap->u_fhp, &fhp, sizeof(fhp));
4347 	if (error)
4348 		return(error);
4349 	/* find the mount point */
4350 	mp = vfs_busyfs(&fhp.fh_fsid);
4351 	if (mp == NULL)
4352 		return (ESTALE);
4353 	/* now give me my vnode, it gets returned to me locked */
4354 	error = VFS_FHTOVP(mp, &fhp.fh_fid, LK_EXCLUSIVE, &vp);
4355 	vfs_unbusy(mp);
4356 	if (error)
4357 		return (error);
4358 
4359 	error = falloc_noinstall(td, &fp);
4360 	if (error) {
4361 		vput(vp);
4362 		return (error);
4363 	}
4364 	/*
4365 	 * An extra reference on `fp' has been held for us by
4366 	 * falloc_noinstall().
4367 	 */
4368 
4369 #ifdef INVARIANTS
4370 	td->td_dupfd = -1;
4371 #endif
4372 	error = vn_open_vnode(vp, fmode, td->td_ucred, td, fp);
4373 	if (error) {
4374 		KASSERT(fp->f_ops == &badfileops,
4375 		    ("VOP_OPEN in fhopen() set f_ops"));
4376 		KASSERT(td->td_dupfd < 0,
4377 		    ("fhopen() encountered fdopen()"));
4378 
4379 		vput(vp);
4380 		goto bad;
4381 	}
4382 #ifdef INVARIANTS
4383 	td->td_dupfd = 0;
4384 #endif
4385 	fp->f_vnode = vp;
4386 	fp->f_seqcount = 1;
4387 	finit(fp, (fmode & FMASK) | (fp->f_flag & FHASLOCK), DTYPE_VNODE, vp,
4388 	    &vnops);
4389 	VOP_UNLOCK(vp, 0);
4390 	if (fmode & O_TRUNC) {
4391 		error = fo_truncate(fp, 0, td->td_ucred, td);
4392 		if (error)
4393 			goto bad;
4394 	}
4395 
4396 	error = finstall(td, fp, &indx, fmode, NULL);
4397 bad:
4398 	fdrop(fp, td);
4399 	td->td_retval[0] = indx;
4400 	return (error);
4401 }
4402 
4403 /*
4404  * Stat an (NFS) file handle.
4405  */
4406 #ifndef _SYS_SYSPROTO_H_
4407 struct fhstat_args {
4408 	struct fhandle *u_fhp;
4409 	struct stat *sb;
4410 };
4411 #endif
4412 int
4413 sys_fhstat(td, uap)
4414 	struct thread *td;
4415 	register struct fhstat_args /* {
4416 		struct fhandle *u_fhp;
4417 		struct stat *sb;
4418 	} */ *uap;
4419 {
4420 	struct stat sb;
4421 	struct fhandle fh;
4422 	int error;
4423 
4424 	error = copyin(uap->u_fhp, &fh, sizeof(fh));
4425 	if (error != 0)
4426 		return (error);
4427 	error = kern_fhstat(td, fh, &sb);
4428 	if (error != 0)
4429 		return (error);
4430 	error = copyout(&sb, uap->sb, sizeof(sb));
4431 	return (error);
4432 }
4433 
4434 int
4435 kern_fhstat(struct thread *td, struct fhandle fh, struct stat *sb)
4436 {
4437 	struct mount *mp;
4438 	struct vnode *vp;
4439 	int error;
4440 
4441 	error = priv_check(td, PRIV_VFS_FHSTAT);
4442 	if (error)
4443 		return (error);
4444 	if ((mp = vfs_busyfs(&fh.fh_fsid)) == NULL)
4445 		return (ESTALE);
4446 	error = VFS_FHTOVP(mp, &fh.fh_fid, LK_EXCLUSIVE, &vp);
4447 	vfs_unbusy(mp);
4448 	if (error)
4449 		return (error);
4450 	error = vn_stat(vp, sb, td->td_ucred, NOCRED, td);
4451 	vput(vp);
4452 	return (error);
4453 }
4454 
4455 /*
4456  * Implement fstatfs() for (NFS) file handles.
4457  */
4458 #ifndef _SYS_SYSPROTO_H_
4459 struct fhstatfs_args {
4460 	struct fhandle *u_fhp;
4461 	struct statfs *buf;
4462 };
4463 #endif
4464 int
4465 sys_fhstatfs(td, uap)
4466 	struct thread *td;
4467 	struct fhstatfs_args /* {
4468 		struct fhandle *u_fhp;
4469 		struct statfs *buf;
4470 	} */ *uap;
4471 {
4472 	struct statfs sf;
4473 	fhandle_t fh;
4474 	int error;
4475 
4476 	error = copyin(uap->u_fhp, &fh, sizeof(fhandle_t));
4477 	if (error)
4478 		return (error);
4479 	error = kern_fhstatfs(td, fh, &sf);
4480 	if (error)
4481 		return (error);
4482 	return (copyout(&sf, uap->buf, sizeof(sf)));
4483 }
4484 
4485 int
4486 kern_fhstatfs(struct thread *td, fhandle_t fh, struct statfs *buf)
4487 {
4488 	struct statfs *sp;
4489 	struct mount *mp;
4490 	struct vnode *vp;
4491 	int error;
4492 
4493 	error = priv_check(td, PRIV_VFS_FHSTATFS);
4494 	if (error)
4495 		return (error);
4496 	if ((mp = vfs_busyfs(&fh.fh_fsid)) == NULL)
4497 		return (ESTALE);
4498 	error = VFS_FHTOVP(mp, &fh.fh_fid, LK_EXCLUSIVE, &vp);
4499 	if (error) {
4500 		vfs_unbusy(mp);
4501 		return (error);
4502 	}
4503 	vput(vp);
4504 	error = prison_canseemount(td->td_ucred, mp);
4505 	if (error)
4506 		goto out;
4507 #ifdef MAC
4508 	error = mac_mount_check_stat(td->td_ucred, mp);
4509 	if (error)
4510 		goto out;
4511 #endif
4512 	/*
4513 	 * Set these in case the underlying filesystem fails to do so.
4514 	 */
4515 	sp = &mp->mnt_stat;
4516 	sp->f_version = STATFS_VERSION;
4517 	sp->f_namemax = NAME_MAX;
4518 	sp->f_flags = mp->mnt_flag & MNT_VISFLAGMASK;
4519 	error = VFS_STATFS(mp, sp);
4520 	if (error == 0)
4521 		*buf = *sp;
4522 out:
4523 	vfs_unbusy(mp);
4524 	return (error);
4525 }
4526 
4527 int
4528 kern_posix_fallocate(struct thread *td, int fd, off_t offset, off_t len)
4529 {
4530 	struct file *fp;
4531 	struct mount *mp;
4532 	struct vnode *vp;
4533 	off_t olen, ooffset;
4534 	int error;
4535 
4536 	fp = NULL;
4537 	error = fget(td, fd, CAP_WRITE, &fp);
4538 	if (error != 0)
4539 		goto out;
4540 
4541 	switch (fp->f_type) {
4542 	case DTYPE_VNODE:
4543 		break;
4544 	case DTYPE_PIPE:
4545 	case DTYPE_FIFO:
4546 		error = ESPIPE;
4547 		goto out;
4548 	default:
4549 		error = ENODEV;
4550 		goto out;
4551 	}
4552 	if ((fp->f_flag & FWRITE) == 0) {
4553 		error = EBADF;
4554 		goto out;
4555 	}
4556 	vp = fp->f_vnode;
4557 	if (vp->v_type != VREG) {
4558 		error = ENODEV;
4559 		goto out;
4560 	}
4561 	if (offset < 0 || len <= 0) {
4562 		error = EINVAL;
4563 		goto out;
4564 	}
4565 	/* Check for wrap. */
4566 	if (offset > OFF_MAX - len) {
4567 		error = EFBIG;
4568 		goto out;
4569 	}
4570 
4571 	/* Allocating blocks may take a long time, so iterate. */
4572 	for (;;) {
4573 		olen = len;
4574 		ooffset = offset;
4575 
4576 		bwillwrite();
4577 		mp = NULL;
4578 		error = vn_start_write(vp, &mp, V_WAIT | PCATCH);
4579 		if (error != 0)
4580 			break;
4581 		error = vn_lock(vp, LK_EXCLUSIVE);
4582 		if (error != 0) {
4583 			vn_finished_write(mp);
4584 			break;
4585 		}
4586 #ifdef MAC
4587 		error = mac_vnode_check_write(td->td_ucred, fp->f_cred, vp);
4588 		if (error == 0)
4589 #endif
4590 			error = VOP_ALLOCATE(vp, &offset, &len);
4591 		VOP_UNLOCK(vp, 0);
4592 		vn_finished_write(mp);
4593 
4594 		if (olen + ooffset != offset + len) {
4595 			panic("offset + len changed from %jx/%jx to %jx/%jx",
4596 			    ooffset, olen, offset, len);
4597 		}
4598 		if (error != 0 || len == 0)
4599 			break;
4600 		KASSERT(olen > len, ("Iteration did not make progress?"));
4601 		maybe_yield();
4602 	}
4603  out:
4604 	if (fp != NULL)
4605 		fdrop(fp, td);
4606 	return (error);
4607 }
4608 
4609 int
4610 sys_posix_fallocate(struct thread *td, struct posix_fallocate_args *uap)
4611 {
4612 
4613 	return (kern_posix_fallocate(td, uap->fd, uap->offset, uap->len));
4614 }
4615 
4616 /*
4617  * Unlike madvise(2), we do not make a best effort to remember every
4618  * possible caching hint.  Instead, we remember the last setting with
4619  * the exception that we will allow POSIX_FADV_NORMAL to adjust the
4620  * region of any current setting.
4621  */
4622 int
4623 kern_posix_fadvise(struct thread *td, int fd, off_t offset, off_t len,
4624     int advice)
4625 {
4626 	struct fadvise_info *fa, *new;
4627 	struct file *fp;
4628 	struct vnode *vp;
4629 	off_t end;
4630 	int error;
4631 
4632 	if (offset < 0 || len < 0 || offset > OFF_MAX - len)
4633 		return (EINVAL);
4634 	switch (advice) {
4635 	case POSIX_FADV_SEQUENTIAL:
4636 	case POSIX_FADV_RANDOM:
4637 	case POSIX_FADV_NOREUSE:
4638 		new = malloc(sizeof(*fa), M_FADVISE, M_WAITOK);
4639 		break;
4640 	case POSIX_FADV_NORMAL:
4641 	case POSIX_FADV_WILLNEED:
4642 	case POSIX_FADV_DONTNEED:
4643 		new = NULL;
4644 		break;
4645 	default:
4646 		return (EINVAL);
4647 	}
4648 	/* XXX: CAP_POSIX_FADVISE? */
4649 	error = fget(td, fd, CAP_NONE, &fp);
4650 	if (error != 0)
4651 		goto out;
4652 
4653 	switch (fp->f_type) {
4654 	case DTYPE_VNODE:
4655 		break;
4656 	case DTYPE_PIPE:
4657 	case DTYPE_FIFO:
4658 		error = ESPIPE;
4659 		goto out;
4660 	default:
4661 		error = ENODEV;
4662 		goto out;
4663 	}
4664 	vp = fp->f_vnode;
4665 	if (vp->v_type != VREG) {
4666 		error = ENODEV;
4667 		goto out;
4668 	}
4669 	if (len == 0)
4670 		end = OFF_MAX;
4671 	else
4672 		end = offset + len - 1;
4673 	switch (advice) {
4674 	case POSIX_FADV_SEQUENTIAL:
4675 	case POSIX_FADV_RANDOM:
4676 	case POSIX_FADV_NOREUSE:
4677 		/*
4678 		 * Try to merge any existing non-standard region with
4679 		 * this new region if possible, otherwise create a new
4680 		 * non-standard region for this request.
4681 		 */
4682 		mtx_pool_lock(mtxpool_sleep, fp);
4683 		fa = fp->f_advice;
4684 		if (fa != NULL && fa->fa_advice == advice &&
4685 		    ((fa->fa_start <= end && fa->fa_end >= offset) ||
4686 		    (end != OFF_MAX && fa->fa_start == end + 1) ||
4687 		    (fa->fa_end != OFF_MAX && fa->fa_end + 1 == offset))) {
4688 			if (offset < fa->fa_start)
4689 				fa->fa_start = offset;
4690 			if (end > fa->fa_end)
4691 				fa->fa_end = end;
4692 		} else {
4693 			new->fa_advice = advice;
4694 			new->fa_start = offset;
4695 			new->fa_end = end;
4696 			new->fa_prevstart = 0;
4697 			new->fa_prevend = 0;
4698 			fp->f_advice = new;
4699 			new = fa;
4700 		}
4701 		mtx_pool_unlock(mtxpool_sleep, fp);
4702 		break;
4703 	case POSIX_FADV_NORMAL:
4704 		/*
4705 		 * If a the "normal" region overlaps with an existing
4706 		 * non-standard region, trim or remove the
4707 		 * non-standard region.
4708 		 */
4709 		mtx_pool_lock(mtxpool_sleep, fp);
4710 		fa = fp->f_advice;
4711 		if (fa != NULL) {
4712 			if (offset <= fa->fa_start && end >= fa->fa_end) {
4713 				new = fa;
4714 				fp->f_advice = NULL;
4715 			} else if (offset <= fa->fa_start &&
4716 			    end >= fa->fa_start)
4717 				fa->fa_start = end + 1;
4718 			else if (offset <= fa->fa_end && end >= fa->fa_end)
4719 				fa->fa_end = offset - 1;
4720 			else if (offset >= fa->fa_start && end <= fa->fa_end) {
4721 				/*
4722 				 * If the "normal" region is a middle
4723 				 * portion of the existing
4724 				 * non-standard region, just remove
4725 				 * the whole thing rather than picking
4726 				 * one side or the other to
4727 				 * preserve.
4728 				 */
4729 				new = fa;
4730 				fp->f_advice = NULL;
4731 			}
4732 		}
4733 		mtx_pool_unlock(mtxpool_sleep, fp);
4734 		break;
4735 	case POSIX_FADV_WILLNEED:
4736 	case POSIX_FADV_DONTNEED:
4737 		error = VOP_ADVISE(vp, offset, end, advice);
4738 		break;
4739 	}
4740 out:
4741 	if (fp != NULL)
4742 		fdrop(fp, td);
4743 	free(new, M_FADVISE);
4744 	return (error);
4745 }
4746 
4747 int
4748 sys_posix_fadvise(struct thread *td, struct posix_fadvise_args *uap)
4749 {
4750 
4751 	return (kern_posix_fadvise(td, uap->fd, uap->offset, uap->len,
4752 	    uap->advice));
4753 }
4754