xref: /illumos-gate/usr/src/uts/common/fs/zfs/zfs_acl.c (revision 922d2c76afbee21520ffa2088c4e60dcb80d3945)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #pragma ident	"%Z%%M%	%I%	%E% SMI"
27 
28 #include <sys/types.h>
29 #include <sys/param.h>
30 #include <sys/time.h>
31 #include <sys/systm.h>
32 #include <sys/sysmacros.h>
33 #include <sys/resource.h>
34 #include <sys/vfs.h>
35 #include <sys/vnode.h>
36 #include <sys/sid.h>
37 #include <sys/file.h>
38 #include <sys/stat.h>
39 #include <sys/kmem.h>
40 #include <sys/cmn_err.h>
41 #include <sys/errno.h>
42 #include <sys/unistd.h>
43 #include <sys/sdt.h>
44 #include <sys/fs/zfs.h>
45 #include <sys/mode.h>
46 #include <sys/policy.h>
47 #include <sys/zfs_znode.h>
48 #include <sys/zfs_fuid.h>
49 #include <sys/zfs_acl.h>
50 #include <sys/zfs_dir.h>
51 #include <sys/zfs_vfsops.h>
52 #include <sys/dmu.h>
53 #include <sys/dnode.h>
54 #include <sys/zap.h>
55 #include "fs/fs_subr.h"
56 #include <acl/acl_common.h>
57 
58 #define	ALLOW	ACE_ACCESS_ALLOWED_ACE_TYPE
59 #define	DENY	ACE_ACCESS_DENIED_ACE_TYPE
60 #define	MAX_ACE_TYPE	ACE_SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE
61 
62 #define	OWNING_GROUP		(ACE_GROUP|ACE_IDENTIFIER_GROUP)
63 #define	EVERYONE_ALLOW_MASK (ACE_READ_ACL|ACE_READ_ATTRIBUTES | \
64     ACE_READ_NAMED_ATTRS|ACE_SYNCHRONIZE)
65 #define	EVERYONE_DENY_MASK (ACE_WRITE_ACL|ACE_WRITE_OWNER | \
66     ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS)
67 #define	OWNER_ALLOW_MASK (ACE_WRITE_ACL | ACE_WRITE_OWNER | \
68     ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS)
69 #define	WRITE_MASK_DATA (ACE_WRITE_DATA|ACE_APPEND_DATA|ACE_WRITE_NAMED_ATTRS)
70 
71 #define	ZFS_CHECKED_MASKS (ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_READ_DATA| \
72     ACE_READ_NAMED_ATTRS|ACE_WRITE_DATA|ACE_WRITE_ATTRIBUTES| \
73     ACE_WRITE_NAMED_ATTRS|ACE_APPEND_DATA|ACE_EXECUTE|ACE_WRITE_OWNER| \
74     ACE_WRITE_ACL|ACE_DELETE|ACE_DELETE_CHILD|ACE_SYNCHRONIZE)
75 
76 #define	WRITE_MASK (WRITE_MASK_DATA|ACE_WRITE_ATTRIBUTES|ACE_WRITE_ACL|\
77     ACE_WRITE_OWNER|ACE_DELETE|ACE_DELETE_CHILD)
78 
79 #define	OGE_CLEAR	(ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \
80     ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE)
81 
82 #define	OKAY_MASK_BITS (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \
83     ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE)
84 
85 #define	ALL_INHERIT	(ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE | \
86     ACE_NO_PROPAGATE_INHERIT_ACE|ACE_INHERIT_ONLY_ACE|ACE_INHERITED_ACE)
87 
88 #define	RESTRICTED_CLEAR	(ACE_WRITE_ACL|ACE_WRITE_OWNER)
89 
90 #define	V4_ACL_WIDE_FLAGS (ZFS_ACL_AUTO_INHERIT|ZFS_ACL_DEFAULTED|\
91     ZFS_ACL_PROTECTED)
92 
93 #define	ZFS_ACL_WIDE_FLAGS (V4_ACL_WIDE_FLAGS|ZFS_ACL_TRIVIAL|ZFS_INHERIT_ACE|\
94     ZFS_ACL_OBJ_ACE)
95 
96 static uint16_t
97 zfs_ace_v0_get_type(void *acep)
98 {
99 	return (((zfs_oldace_t *)acep)->z_type);
100 }
101 
102 static uint16_t
103 zfs_ace_v0_get_flags(void *acep)
104 {
105 	return (((zfs_oldace_t *)acep)->z_flags);
106 }
107 
108 static uint32_t
109 zfs_ace_v0_get_mask(void *acep)
110 {
111 	return (((zfs_oldace_t *)acep)->z_access_mask);
112 }
113 
114 static uint64_t
115 zfs_ace_v0_get_who(void *acep)
116 {
117 	return (((zfs_oldace_t *)acep)->z_fuid);
118 }
119 
120 static void
121 zfs_ace_v0_set_type(void *acep, uint16_t type)
122 {
123 	((zfs_oldace_t *)acep)->z_type = type;
124 }
125 
126 static void
127 zfs_ace_v0_set_flags(void *acep, uint16_t flags)
128 {
129 	((zfs_oldace_t *)acep)->z_flags = flags;
130 }
131 
132 static void
133 zfs_ace_v0_set_mask(void *acep, uint32_t mask)
134 {
135 	((zfs_oldace_t *)acep)->z_access_mask = mask;
136 }
137 
138 static void
139 zfs_ace_v0_set_who(void *acep, uint64_t who)
140 {
141 	((zfs_oldace_t *)acep)->z_fuid = who;
142 }
143 
144 /*ARGSUSED*/
145 static size_t
146 zfs_ace_v0_size(void *acep)
147 {
148 	return (sizeof (zfs_oldace_t));
149 }
150 
151 static size_t
152 zfs_ace_v0_abstract_size(void)
153 {
154 	return (sizeof (zfs_oldace_t));
155 }
156 
157 static int
158 zfs_ace_v0_mask_off(void)
159 {
160 	return (offsetof(zfs_oldace_t, z_access_mask));
161 }
162 
163 /*ARGSUSED*/
164 static int
165 zfs_ace_v0_data(void *acep, void **datap)
166 {
167 	*datap = NULL;
168 	return (0);
169 }
170 
171 static acl_ops_t zfs_acl_v0_ops = {
172 	zfs_ace_v0_get_mask,
173 	zfs_ace_v0_set_mask,
174 	zfs_ace_v0_get_flags,
175 	zfs_ace_v0_set_flags,
176 	zfs_ace_v0_get_type,
177 	zfs_ace_v0_set_type,
178 	zfs_ace_v0_get_who,
179 	zfs_ace_v0_set_who,
180 	zfs_ace_v0_size,
181 	zfs_ace_v0_abstract_size,
182 	zfs_ace_v0_mask_off,
183 	zfs_ace_v0_data
184 };
185 
186 static uint16_t
187 zfs_ace_fuid_get_type(void *acep)
188 {
189 	return (((zfs_ace_hdr_t *)acep)->z_type);
190 }
191 
192 static uint16_t
193 zfs_ace_fuid_get_flags(void *acep)
194 {
195 	return (((zfs_ace_hdr_t *)acep)->z_flags);
196 }
197 
198 static uint32_t
199 zfs_ace_fuid_get_mask(void *acep)
200 {
201 	return (((zfs_ace_hdr_t *)acep)->z_access_mask);
202 }
203 
204 static uint64_t
205 zfs_ace_fuid_get_who(void *args)
206 {
207 	uint16_t entry_type;
208 	zfs_ace_t *acep = args;
209 
210 	entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS;
211 
212 	if (entry_type == ACE_OWNER || entry_type == OWNING_GROUP ||
213 	    entry_type == ACE_EVERYONE)
214 		return (-1);
215 	return (((zfs_ace_t *)acep)->z_fuid);
216 }
217 
218 static void
219 zfs_ace_fuid_set_type(void *acep, uint16_t type)
220 {
221 	((zfs_ace_hdr_t *)acep)->z_type = type;
222 }
223 
224 static void
225 zfs_ace_fuid_set_flags(void *acep, uint16_t flags)
226 {
227 	((zfs_ace_hdr_t *)acep)->z_flags = flags;
228 }
229 
230 static void
231 zfs_ace_fuid_set_mask(void *acep, uint32_t mask)
232 {
233 	((zfs_ace_hdr_t *)acep)->z_access_mask = mask;
234 }
235 
236 static void
237 zfs_ace_fuid_set_who(void *arg, uint64_t who)
238 {
239 	zfs_ace_t *acep = arg;
240 
241 	uint16_t entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS;
242 
243 	if (entry_type == ACE_OWNER || entry_type == OWNING_GROUP ||
244 	    entry_type == ACE_EVERYONE)
245 		return;
246 	acep->z_fuid = who;
247 }
248 
249 static size_t
250 zfs_ace_fuid_size(void *acep)
251 {
252 	zfs_ace_hdr_t *zacep = acep;
253 	uint16_t entry_type;
254 
255 	switch (zacep->z_type) {
256 	case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
257 	case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
258 	case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
259 	case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
260 		return (sizeof (zfs_object_ace_t));
261 	case ALLOW:
262 	case DENY:
263 		entry_type =
264 		    (((zfs_ace_hdr_t *)acep)->z_flags & ACE_TYPE_FLAGS);
265 		if (entry_type == ACE_OWNER ||
266 		    entry_type == (ACE_GROUP | ACE_IDENTIFIER_GROUP) ||
267 		    entry_type == ACE_EVERYONE)
268 			return (sizeof (zfs_ace_hdr_t));
269 		/*FALLTHROUGH*/
270 	default:
271 		return (sizeof (zfs_ace_t));
272 	}
273 }
274 
275 static size_t
276 zfs_ace_fuid_abstract_size(void)
277 {
278 	return (sizeof (zfs_ace_hdr_t));
279 }
280 
281 static int
282 zfs_ace_fuid_mask_off(void)
283 {
284 	return (offsetof(zfs_ace_hdr_t, z_access_mask));
285 }
286 
287 static int
288 zfs_ace_fuid_data(void *acep, void **datap)
289 {
290 	zfs_ace_t *zacep = acep;
291 	zfs_object_ace_t *zobjp;
292 
293 	switch (zacep->z_hdr.z_type) {
294 	case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
295 	case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
296 	case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
297 	case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
298 		zobjp = acep;
299 		*datap = (caddr_t)zobjp + sizeof (zfs_ace_t);
300 		return (sizeof (zfs_object_ace_t) - sizeof (zfs_ace_t));
301 	default:
302 		*datap = NULL;
303 		return (0);
304 	}
305 }
306 
307 static acl_ops_t zfs_acl_fuid_ops = {
308 	zfs_ace_fuid_get_mask,
309 	zfs_ace_fuid_set_mask,
310 	zfs_ace_fuid_get_flags,
311 	zfs_ace_fuid_set_flags,
312 	zfs_ace_fuid_get_type,
313 	zfs_ace_fuid_set_type,
314 	zfs_ace_fuid_get_who,
315 	zfs_ace_fuid_set_who,
316 	zfs_ace_fuid_size,
317 	zfs_ace_fuid_abstract_size,
318 	zfs_ace_fuid_mask_off,
319 	zfs_ace_fuid_data
320 };
321 
322 static int
323 zfs_acl_version(int version)
324 {
325 	if (version < ZPL_VERSION_FUID)
326 		return (ZFS_ACL_VERSION_INITIAL);
327 	else
328 		return (ZFS_ACL_VERSION_FUID);
329 }
330 
331 static int
332 zfs_acl_version_zp(znode_t *zp)
333 {
334 	return (zfs_acl_version(zp->z_zfsvfs->z_version));
335 }
336 
337 static zfs_acl_t *
338 zfs_acl_alloc(int vers)
339 {
340 	zfs_acl_t *aclp;
341 
342 	aclp = kmem_zalloc(sizeof (zfs_acl_t), KM_SLEEP);
343 	list_create(&aclp->z_acl, sizeof (zfs_acl_node_t),
344 	    offsetof(zfs_acl_node_t, z_next));
345 	aclp->z_version = vers;
346 	if (vers == ZFS_ACL_VERSION_FUID)
347 		aclp->z_ops = zfs_acl_fuid_ops;
348 	else
349 		aclp->z_ops = zfs_acl_v0_ops;
350 	return (aclp);
351 }
352 
353 static zfs_acl_node_t *
354 zfs_acl_node_alloc(size_t bytes)
355 {
356 	zfs_acl_node_t *aclnode;
357 
358 	aclnode = kmem_zalloc(sizeof (zfs_acl_node_t), KM_SLEEP);
359 	if (bytes) {
360 		aclnode->z_acldata = kmem_alloc(bytes, KM_SLEEP);
361 		aclnode->z_allocdata = aclnode->z_acldata;
362 		aclnode->z_allocsize = bytes;
363 		aclnode->z_size = bytes;
364 	}
365 
366 	return (aclnode);
367 }
368 
369 static void
370 zfs_acl_node_free(zfs_acl_node_t *aclnode)
371 {
372 	if (aclnode->z_allocsize)
373 		kmem_free(aclnode->z_allocdata, aclnode->z_allocsize);
374 	kmem_free(aclnode, sizeof (zfs_acl_node_t));
375 }
376 
377 static void
378 zfs_acl_release_nodes(zfs_acl_t *aclp)
379 {
380 	zfs_acl_node_t *aclnode;
381 
382 	while (aclnode = list_head(&aclp->z_acl)) {
383 		list_remove(&aclp->z_acl, aclnode);
384 		zfs_acl_node_free(aclnode);
385 	}
386 	aclp->z_acl_count = 0;
387 	aclp->z_acl_bytes = 0;
388 }
389 
390 void
391 zfs_acl_free(zfs_acl_t *aclp)
392 {
393 	zfs_acl_release_nodes(aclp);
394 	list_destroy(&aclp->z_acl);
395 	kmem_free(aclp, sizeof (zfs_acl_t));
396 }
397 
398 static boolean_t
399 zfs_ace_valid(vtype_t obj_type, zfs_acl_t *aclp, uint16_t type, uint16_t iflags)
400 {
401 	/*
402 	 * first check type of entry
403 	 */
404 
405 	switch (iflags & ACE_TYPE_FLAGS) {
406 	case ACE_OWNER:
407 	case (ACE_IDENTIFIER_GROUP | ACE_GROUP):
408 	case ACE_IDENTIFIER_GROUP:
409 	case ACE_EVERYONE:
410 	case 0:	/* User entry */
411 		break;
412 	default:
413 		return (B_FALSE);
414 
415 	}
416 
417 	/*
418 	 * next check inheritance level flags
419 	 */
420 
421 	if (type != ALLOW && type > MAX_ACE_TYPE) {
422 		return (B_FALSE);
423 	}
424 
425 	switch (type) {
426 	case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
427 	case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
428 	case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
429 	case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
430 		if (aclp->z_version < ZFS_ACL_VERSION_FUID)
431 			return (B_FALSE);
432 		aclp->z_hints |= ZFS_ACL_OBJ_ACE;
433 	}
434 
435 	if (obj_type == VDIR &&
436 	    (iflags & (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE)))
437 		aclp->z_hints |= ZFS_INHERIT_ACE;
438 
439 	if (iflags & (ACE_INHERIT_ONLY_ACE|ACE_NO_PROPAGATE_INHERIT_ACE)) {
440 		if ((iflags & (ACE_FILE_INHERIT_ACE|
441 		    ACE_DIRECTORY_INHERIT_ACE)) == 0) {
442 			return (B_FALSE);
443 		}
444 	}
445 
446 	return (B_TRUE);
447 }
448 
449 static void *
450 zfs_acl_next_ace(zfs_acl_t *aclp, void *start, uint64_t *who,
451     uint32_t *access_mask, uint16_t *iflags, uint16_t *type)
452 {
453 	zfs_acl_node_t *aclnode;
454 
455 	if (start == NULL) {
456 		aclnode = list_head(&aclp->z_acl);
457 		if (aclnode == NULL)
458 			return (NULL);
459 
460 		aclp->z_next_ace = aclnode->z_acldata;
461 		aclp->z_curr_node = aclnode;
462 		aclnode->z_ace_idx = 0;
463 	}
464 
465 	aclnode = aclp->z_curr_node;
466 
467 	if (aclnode == NULL)
468 		return (NULL);
469 
470 	if (aclnode->z_ace_idx >= aclnode->z_ace_count) {
471 		aclnode = list_next(&aclp->z_acl, aclnode);
472 		if (aclnode == NULL)
473 			return (NULL);
474 		else {
475 			aclp->z_curr_node = aclnode;
476 			aclnode->z_ace_idx = 0;
477 			aclp->z_next_ace = aclnode->z_acldata;
478 		}
479 	}
480 
481 	if (aclnode->z_ace_idx < aclnode->z_ace_count) {
482 		void *acep = aclp->z_next_ace;
483 		*iflags = aclp->z_ops.ace_flags_get(acep);
484 		*type = aclp->z_ops.ace_type_get(acep);
485 		*access_mask = aclp->z_ops.ace_mask_get(acep);
486 		*who = aclp->z_ops.ace_who_get(acep);
487 		aclp->z_next_ace = (caddr_t)aclp->z_next_ace +
488 		    aclp->z_ops.ace_size(acep);
489 		aclnode->z_ace_idx++;
490 		return ((void *)acep);
491 	}
492 	return (NULL);
493 }
494 
495 /*ARGSUSED*/
496 static uint64_t
497 zfs_ace_walk(void *datap, uint64_t cookie, int aclcnt,
498     uint16_t *flags, uint16_t *type, uint32_t *mask)
499 {
500 	zfs_acl_t *aclp = datap;
501 	zfs_ace_hdr_t *acep = (zfs_ace_hdr_t *)(uintptr_t)cookie;
502 	uint64_t who;
503 
504 	acep = zfs_acl_next_ace(aclp, acep, &who, mask,
505 	    flags, type);
506 	return ((uint64_t)(uintptr_t)acep);
507 }
508 
509 static zfs_acl_node_t *
510 zfs_acl_curr_node(zfs_acl_t *aclp)
511 {
512 	ASSERT(aclp->z_curr_node);
513 	return (aclp->z_curr_node);
514 }
515 
516 /*
517  * Copy ACE to internal ZFS format.
518  * While processing the ACL each ACE will be validated for correctness.
519  * ACE FUIDs will be created later.
520  */
521 int
522 zfs_copy_ace_2_fuid(vtype_t obj_type, zfs_acl_t *aclp, void *datap,
523     zfs_ace_t *z_acl, int aclcnt, size_t *size)
524 {
525 	int i;
526 	uint16_t entry_type;
527 	zfs_ace_t *aceptr = z_acl;
528 	ace_t *acep = datap;
529 	zfs_object_ace_t *zobjacep;
530 	ace_object_t *aceobjp;
531 
532 	for (i = 0; i != aclcnt; i++) {
533 		aceptr->z_hdr.z_access_mask = acep->a_access_mask;
534 		aceptr->z_hdr.z_flags = acep->a_flags;
535 		aceptr->z_hdr.z_type = acep->a_type;
536 		entry_type = aceptr->z_hdr.z_flags & ACE_TYPE_FLAGS;
537 		if (entry_type != ACE_OWNER && entry_type != OWNING_GROUP &&
538 		    entry_type != ACE_EVERYONE) {
539 			if (!aclp->z_has_fuids)
540 				aclp->z_has_fuids = IS_EPHEMERAL(acep->a_who);
541 			aceptr->z_fuid = (uint64_t)acep->a_who;
542 		}
543 
544 		/*
545 		 * Make sure ACE is valid
546 		 */
547 		if (zfs_ace_valid(obj_type, aclp, aceptr->z_hdr.z_type,
548 		    aceptr->z_hdr.z_flags) != B_TRUE)
549 			return (EINVAL);
550 
551 		switch (acep->a_type) {
552 		case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
553 		case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
554 		case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
555 		case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
556 			zobjacep = (zfs_object_ace_t *)aceptr;
557 			aceobjp = (ace_object_t *)acep;
558 
559 			bcopy(aceobjp->a_obj_type, zobjacep->z_object_type,
560 			    sizeof (aceobjp->a_obj_type));
561 			bcopy(aceobjp->a_inherit_obj_type,
562 			    zobjacep->z_inherit_type,
563 			    sizeof (aceobjp->a_inherit_obj_type));
564 			acep = (ace_t *)((caddr_t)acep + sizeof (ace_object_t));
565 			break;
566 		default:
567 			acep = (ace_t *)((caddr_t)acep + sizeof (ace_t));
568 		}
569 
570 		aceptr = (zfs_ace_t *)((caddr_t)aceptr +
571 		    aclp->z_ops.ace_size(aceptr));
572 	}
573 
574 	*size = (caddr_t)aceptr - (caddr_t)z_acl;
575 
576 	return (0);
577 }
578 
579 /*
580  * Copy ZFS ACEs to fixed size ace_t layout
581  */
582 static void
583 zfs_copy_fuid_2_ace(zfsvfs_t *zfsvfs, zfs_acl_t *aclp, cred_t *cr,
584     void *datap, int filter)
585 {
586 	uint64_t who;
587 	uint32_t access_mask;
588 	uint16_t iflags, type;
589 	zfs_ace_hdr_t *zacep = NULL;
590 	ace_t *acep = datap;
591 	ace_object_t *objacep;
592 	zfs_object_ace_t *zobjacep;
593 	size_t ace_size;
594 	uint16_t entry_type;
595 
596 	while (zacep = zfs_acl_next_ace(aclp, zacep,
597 	    &who, &access_mask, &iflags, &type)) {
598 
599 		switch (type) {
600 		case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
601 		case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
602 		case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
603 		case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
604 			if (filter) {
605 				continue;
606 			}
607 			zobjacep = (zfs_object_ace_t *)zacep;
608 			objacep = (ace_object_t *)acep;
609 			bcopy(zobjacep->z_object_type,
610 			    objacep->a_obj_type,
611 			    sizeof (zobjacep->z_object_type));
612 			bcopy(zobjacep->z_inherit_type,
613 			    objacep->a_inherit_obj_type,
614 			    sizeof (zobjacep->z_inherit_type));
615 			ace_size = sizeof (ace_object_t);
616 			break;
617 		default:
618 			ace_size = sizeof (ace_t);
619 			break;
620 		}
621 
622 		entry_type = (iflags & ACE_TYPE_FLAGS);
623 		if ((entry_type != ACE_OWNER &&
624 		    entry_type != (ACE_GROUP | ACE_IDENTIFIER_GROUP) &&
625 		    entry_type != ACE_EVERYONE)) {
626 			acep->a_who = zfs_fuid_map_id(zfsvfs, who,
627 			    cr, (entry_type & ACE_IDENTIFIER_GROUP) ?
628 			    ZFS_ACE_GROUP : ZFS_ACE_USER);
629 		} else {
630 			acep->a_who = (uid_t)(int64_t)who;
631 		}
632 		acep->a_access_mask = access_mask;
633 		acep->a_flags = iflags;
634 		acep->a_type = type;
635 		acep = (ace_t *)((caddr_t)acep + ace_size);
636 	}
637 }
638 
639 static int
640 zfs_copy_ace_2_oldace(vtype_t obj_type, zfs_acl_t *aclp, ace_t *acep,
641     zfs_oldace_t *z_acl, int aclcnt, size_t *size)
642 {
643 	int i;
644 	zfs_oldace_t *aceptr = z_acl;
645 
646 	for (i = 0; i != aclcnt; i++, aceptr++) {
647 		aceptr->z_access_mask = acep[i].a_access_mask;
648 		aceptr->z_type = acep[i].a_type;
649 		aceptr->z_flags = acep[i].a_flags;
650 		aceptr->z_fuid = acep[i].a_who;
651 		/*
652 		 * Make sure ACE is valid
653 		 */
654 		if (zfs_ace_valid(obj_type, aclp, aceptr->z_type,
655 		    aceptr->z_flags) != B_TRUE)
656 			return (EINVAL);
657 	}
658 	*size = (caddr_t)aceptr - (caddr_t)z_acl;
659 	return (0);
660 }
661 
662 /*
663  * convert old ACL format to new
664  */
665 void
666 zfs_acl_xform(znode_t *zp, zfs_acl_t *aclp)
667 {
668 	zfs_oldace_t *oldaclp;
669 	int i;
670 	uint16_t type, iflags;
671 	uint32_t access_mask;
672 	uint64_t who;
673 	void *cookie = NULL;
674 	zfs_acl_node_t *newaclnode;
675 
676 	ASSERT(aclp->z_version == ZFS_ACL_VERSION_INITIAL);
677 	/*
678 	 * First create the ACE in a contiguous piece of memory
679 	 * for zfs_copy_ace_2_fuid().
680 	 *
681 	 * We only convert an ACL once, so this won't happen
682 	 * everytime.
683 	 */
684 	oldaclp = kmem_alloc(sizeof (zfs_oldace_t) * aclp->z_acl_count,
685 	    KM_SLEEP);
686 	i = 0;
687 	while (cookie = zfs_acl_next_ace(aclp, cookie, &who,
688 	    &access_mask, &iflags, &type)) {
689 		oldaclp[i].z_flags = iflags;
690 		oldaclp[i].z_type = type;
691 		oldaclp[i].z_fuid = who;
692 		oldaclp[i++].z_access_mask = access_mask;
693 	}
694 
695 	newaclnode = zfs_acl_node_alloc(aclp->z_acl_count *
696 	    sizeof (zfs_object_ace_t));
697 	aclp->z_ops = zfs_acl_fuid_ops;
698 	VERIFY(zfs_copy_ace_2_fuid(ZTOV(zp)->v_type, aclp, oldaclp,
699 	    newaclnode->z_acldata, aclp->z_acl_count,
700 	    &newaclnode->z_size) == 0);
701 	newaclnode->z_ace_count = aclp->z_acl_count;
702 	aclp->z_version = ZFS_ACL_VERSION;
703 	kmem_free(oldaclp, aclp->z_acl_count * sizeof (zfs_oldace_t));
704 
705 	/*
706 	 * Release all previous ACL nodes
707 	 */
708 
709 	zfs_acl_release_nodes(aclp);
710 
711 	list_insert_head(&aclp->z_acl, newaclnode);
712 
713 	aclp->z_acl_bytes = newaclnode->z_size;
714 	aclp->z_acl_count = newaclnode->z_ace_count;
715 
716 }
717 
718 /*
719  * Convert unix access mask to v4 access mask
720  */
721 static uint32_t
722 zfs_unix_to_v4(uint32_t access_mask)
723 {
724 	uint32_t new_mask = 0;
725 
726 	if (access_mask & S_IXOTH)
727 		new_mask |= ACE_EXECUTE;
728 	if (access_mask & S_IWOTH)
729 		new_mask |= ACE_WRITE_DATA;
730 	if (access_mask & S_IROTH)
731 		new_mask |= ACE_READ_DATA;
732 	return (new_mask);
733 }
734 
735 static void
736 zfs_set_ace(zfs_acl_t *aclp, void *acep, uint32_t access_mask,
737     uint16_t access_type, uint64_t fuid, uint16_t entry_type)
738 {
739 	uint16_t type = entry_type & ACE_TYPE_FLAGS;
740 
741 	aclp->z_ops.ace_mask_set(acep, access_mask);
742 	aclp->z_ops.ace_type_set(acep, access_type);
743 	aclp->z_ops.ace_flags_set(acep, entry_type);
744 	if ((type != ACE_OWNER && type != (ACE_GROUP | ACE_IDENTIFIER_GROUP) &&
745 	    type != ACE_EVERYONE))
746 		aclp->z_ops.ace_who_set(acep, fuid);
747 }
748 
749 /*
750  * Determine mode of file based on ACL.
751  * Also, create FUIDs for any User/Group ACEs
752  */
753 static uint64_t
754 zfs_mode_fuid_compute(znode_t *zp, zfs_acl_t *aclp, cred_t *cr,
755     zfs_fuid_info_t **fuidp, dmu_tx_t *tx)
756 {
757 	int		entry_type;
758 	mode_t		mode;
759 	mode_t		seen = 0;
760 	zfs_ace_hdr_t 	*acep = NULL;
761 	uint64_t	who;
762 	uint16_t	iflags, type;
763 	uint32_t	access_mask;
764 
765 	mode = (zp->z_phys->zp_mode & (S_IFMT | S_ISUID | S_ISGID | S_ISVTX));
766 
767 	while (acep = zfs_acl_next_ace(aclp, acep, &who,
768 	    &access_mask, &iflags, &type)) {
769 
770 		/*
771 		 * Skip over inherit only ACEs
772 		 */
773 		if (iflags & ACE_INHERIT_ONLY_ACE)
774 			continue;
775 
776 		entry_type = (iflags & ACE_TYPE_FLAGS);
777 
778 		if (entry_type == ACE_OWNER) {
779 			if ((access_mask & ACE_READ_DATA) &&
780 			    (!(seen & S_IRUSR))) {
781 				seen |= S_IRUSR;
782 				if (type == ALLOW) {
783 					mode |= S_IRUSR;
784 				}
785 			}
786 			if ((access_mask & ACE_WRITE_DATA) &&
787 			    (!(seen & S_IWUSR))) {
788 				seen |= S_IWUSR;
789 				if (type == ALLOW) {
790 					mode |= S_IWUSR;
791 				}
792 			}
793 			if ((access_mask & ACE_EXECUTE) &&
794 			    (!(seen & S_IXUSR))) {
795 				seen |= S_IXUSR;
796 				if (type == ALLOW) {
797 					mode |= S_IXUSR;
798 				}
799 			}
800 		} else if (entry_type == OWNING_GROUP) {
801 			if ((access_mask & ACE_READ_DATA) &&
802 			    (!(seen & S_IRGRP))) {
803 				seen |= S_IRGRP;
804 				if (type == ALLOW) {
805 					mode |= S_IRGRP;
806 				}
807 			}
808 			if ((access_mask & ACE_WRITE_DATA) &&
809 			    (!(seen & S_IWGRP))) {
810 				seen |= S_IWGRP;
811 				if (type == ALLOW) {
812 					mode |= S_IWGRP;
813 				}
814 			}
815 			if ((access_mask & ACE_EXECUTE) &&
816 			    (!(seen & S_IXGRP))) {
817 				seen |= S_IXGRP;
818 				if (type == ALLOW) {
819 					mode |= S_IXGRP;
820 				}
821 			}
822 		} else if (entry_type == ACE_EVERYONE) {
823 			if ((access_mask & ACE_READ_DATA)) {
824 				if (!(seen & S_IRUSR)) {
825 					seen |= S_IRUSR;
826 					if (type == ALLOW) {
827 						mode |= S_IRUSR;
828 					}
829 				}
830 				if (!(seen & S_IRGRP)) {
831 					seen |= S_IRGRP;
832 					if (type == ALLOW) {
833 						mode |= S_IRGRP;
834 					}
835 				}
836 				if (!(seen & S_IROTH)) {
837 					seen |= S_IROTH;
838 					if (type == ALLOW) {
839 						mode |= S_IROTH;
840 					}
841 				}
842 			}
843 			if ((access_mask & ACE_WRITE_DATA)) {
844 				if (!(seen & S_IWUSR)) {
845 					seen |= S_IWUSR;
846 					if (type == ALLOW) {
847 						mode |= S_IWUSR;
848 					}
849 				}
850 				if (!(seen & S_IWGRP)) {
851 					seen |= S_IWGRP;
852 					if (type == ALLOW) {
853 						mode |= S_IWGRP;
854 					}
855 				}
856 				if (!(seen & S_IWOTH)) {
857 					seen |= S_IWOTH;
858 					if (type == ALLOW) {
859 						mode |= S_IWOTH;
860 					}
861 				}
862 			}
863 			if ((access_mask & ACE_EXECUTE)) {
864 				if (!(seen & S_IXUSR)) {
865 					seen |= S_IXUSR;
866 					if (type == ALLOW) {
867 						mode |= S_IXUSR;
868 					}
869 				}
870 				if (!(seen & S_IXGRP)) {
871 					seen |= S_IXGRP;
872 					if (type == ALLOW) {
873 						mode |= S_IXGRP;
874 					}
875 				}
876 				if (!(seen & S_IXOTH)) {
877 					seen |= S_IXOTH;
878 					if (type == ALLOW) {
879 						mode |= S_IXOTH;
880 					}
881 				}
882 			}
883 		}
884 		/*
885 		 * Now handle FUID create for user/group ACEs
886 		 */
887 		if (entry_type == 0 || entry_type == ACE_IDENTIFIER_GROUP) {
888 			aclp->z_ops.ace_who_set(acep,
889 			    zfs_fuid_create(zp->z_zfsvfs, who, cr,
890 			    (entry_type == 0) ? ZFS_ACE_USER : ZFS_ACE_GROUP,
891 			    tx, fuidp));
892 		}
893 	}
894 	return (mode);
895 }
896 
897 static zfs_acl_t *
898 zfs_acl_node_read_internal(znode_t *zp, boolean_t will_modify)
899 {
900 	zfs_acl_t	*aclp;
901 	zfs_acl_node_t	*aclnode;
902 
903 	aclp = zfs_acl_alloc(zp->z_phys->zp_acl.z_acl_version);
904 
905 	/*
906 	 * Version 0 to 1 znode_acl_phys has the size/count fields swapped.
907 	 * Version 0 didn't have a size field, only a count.
908 	 */
909 	if (zp->z_phys->zp_acl.z_acl_version == ZFS_ACL_VERSION_INITIAL) {
910 		aclp->z_acl_count = zp->z_phys->zp_acl.z_acl_size;
911 		aclp->z_acl_bytes = ZFS_ACL_SIZE(aclp->z_acl_count);
912 	} else {
913 		aclp->z_acl_count = zp->z_phys->zp_acl.z_acl_count;
914 		aclp->z_acl_bytes = zp->z_phys->zp_acl.z_acl_size;
915 	}
916 
917 	aclnode = zfs_acl_node_alloc(will_modify ? aclp->z_acl_bytes : 0);
918 	aclnode->z_ace_count = aclp->z_acl_count;
919 	if (will_modify) {
920 		bcopy(zp->z_phys->zp_acl.z_ace_data, aclnode->z_acldata,
921 		    aclp->z_acl_bytes);
922 	} else {
923 		aclnode->z_size = aclp->z_acl_bytes;
924 		aclnode->z_acldata = &zp->z_phys->zp_acl.z_ace_data[0];
925 	}
926 
927 	list_insert_head(&aclp->z_acl, aclnode);
928 
929 	return (aclp);
930 }
931 
932 /*
933  * Read an external acl object.
934  */
935 static int
936 zfs_acl_node_read(znode_t *zp, zfs_acl_t **aclpp, boolean_t will_modify)
937 {
938 	uint64_t extacl = zp->z_phys->zp_acl.z_acl_extern_obj;
939 	zfs_acl_t	*aclp;
940 	size_t		aclsize;
941 	size_t		acl_count;
942 	zfs_acl_node_t	*aclnode;
943 	int error;
944 
945 	ASSERT(MUTEX_HELD(&zp->z_acl_lock));
946 
947 	if (zp->z_phys->zp_acl.z_acl_extern_obj == 0) {
948 		*aclpp = zfs_acl_node_read_internal(zp, will_modify);
949 		return (0);
950 	}
951 
952 	aclp = zfs_acl_alloc(zp->z_phys->zp_acl.z_acl_version);
953 	if (zp->z_phys->zp_acl.z_acl_version == ZFS_ACL_VERSION_INITIAL) {
954 		zfs_acl_phys_v0_t *zacl0 =
955 		    (zfs_acl_phys_v0_t *)&zp->z_phys->zp_acl;
956 
957 		aclsize = ZFS_ACL_SIZE(zacl0->z_acl_count);
958 		acl_count = zacl0->z_acl_count;
959 	} else {
960 		aclsize = zp->z_phys->zp_acl.z_acl_size;
961 		acl_count = zp->z_phys->zp_acl.z_acl_count;
962 		if (aclsize == 0)
963 			aclsize = acl_count * sizeof (zfs_ace_t);
964 	}
965 	aclnode = zfs_acl_node_alloc(aclsize);
966 	list_insert_head(&aclp->z_acl, aclnode);
967 	error = dmu_read(zp->z_zfsvfs->z_os, extacl, 0,
968 	    aclsize, aclnode->z_acldata);
969 	aclnode->z_ace_count = acl_count;
970 	aclp->z_acl_count = acl_count;
971 	aclp->z_acl_bytes = aclsize;
972 
973 	if (error != 0) {
974 		zfs_acl_free(aclp);
975 		return (error);
976 	}
977 
978 	*aclpp = aclp;
979 	return (0);
980 }
981 
982 /*
983  * common code for setting ACLs.
984  *
985  * This function is called from zfs_mode_update, zfs_perm_init, and zfs_setacl.
986  * zfs_setacl passes a non-NULL inherit pointer (ihp) to indicate that it's
987  * already checked the acl and knows whether to inherit.
988  */
989 int
990 zfs_aclset_common(znode_t *zp, zfs_acl_t *aclp, cred_t *cr,
991     zfs_fuid_info_t **fuidp, dmu_tx_t *tx)
992 {
993 	int		error;
994 	znode_phys_t	*zphys = zp->z_phys;
995 	zfs_acl_phys_t	*zacl = &zphys->zp_acl;
996 	zfsvfs_t	*zfsvfs = zp->z_zfsvfs;
997 	uint64_t	aoid = zphys->zp_acl.z_acl_extern_obj;
998 	uint64_t	off = 0;
999 	dmu_object_type_t otype;
1000 	zfs_acl_node_t	*aclnode;
1001 
1002 	ASSERT(MUTEX_HELD(&zp->z_lock));
1003 	ASSERT(MUTEX_HELD(&zp->z_acl_lock));
1004 
1005 	dmu_buf_will_dirty(zp->z_dbuf, tx);
1006 
1007 	zphys->zp_mode = zfs_mode_fuid_compute(zp, aclp, cr, fuidp, tx);
1008 
1009 	/*
1010 	 * Decide which opbject type to use.  If we are forced to
1011 	 * use old ACL format than transform ACL into zfs_oldace_t
1012 	 * layout.
1013 	 */
1014 	if (!zfsvfs->z_use_fuids) {
1015 		otype = DMU_OT_OLDACL;
1016 	} else {
1017 		if ((aclp->z_version == ZFS_ACL_VERSION_INITIAL) &&
1018 		    (zfsvfs->z_version >= ZPL_VERSION_FUID))
1019 			zfs_acl_xform(zp, aclp);
1020 		ASSERT(aclp->z_version >= ZFS_ACL_VERSION_FUID);
1021 		otype = DMU_OT_ACL;
1022 	}
1023 
1024 	if (aclp->z_acl_bytes > ZFS_ACE_SPACE) {
1025 		/*
1026 		 * If ACL was previously external and we are now
1027 		 * converting to new ACL format then release old
1028 		 * ACL object and create a new one.
1029 		 */
1030 		if (aoid && aclp->z_version != zacl->z_acl_version) {
1031 			error = dmu_object_free(zfsvfs->z_os,
1032 			    zp->z_phys->zp_acl.z_acl_extern_obj, tx);
1033 			if (error)
1034 				return (error);
1035 			aoid = 0;
1036 		}
1037 		if (aoid == 0) {
1038 			aoid = dmu_object_alloc(zfsvfs->z_os,
1039 			    otype, aclp->z_acl_bytes,
1040 			    otype == DMU_OT_ACL ? DMU_OT_SYSACL : DMU_OT_NONE,
1041 			    otype == DMU_OT_ACL ? DN_MAX_BONUSLEN : 0, tx);
1042 		} else {
1043 			(void) dmu_object_set_blocksize(zfsvfs->z_os, aoid,
1044 			    aclp->z_acl_bytes, 0, tx);
1045 		}
1046 		zphys->zp_acl.z_acl_extern_obj = aoid;
1047 		for (aclnode = list_head(&aclp->z_acl); aclnode;
1048 		    aclnode = list_next(&aclp->z_acl, aclnode)) {
1049 			if (aclnode->z_ace_count == 0)
1050 				continue;
1051 			dmu_write(zfsvfs->z_os, aoid, off,
1052 			    aclnode->z_size, aclnode->z_acldata, tx);
1053 			off += aclnode->z_size;
1054 		}
1055 	} else {
1056 		void *start = zacl->z_ace_data;
1057 		/*
1058 		 * Migrating back embedded?
1059 		 */
1060 		if (zphys->zp_acl.z_acl_extern_obj) {
1061 			error = dmu_object_free(zfsvfs->z_os,
1062 			    zp->z_phys->zp_acl.z_acl_extern_obj, tx);
1063 			if (error)
1064 				return (error);
1065 			zphys->zp_acl.z_acl_extern_obj = 0;
1066 		}
1067 
1068 		for (aclnode = list_head(&aclp->z_acl); aclnode;
1069 		    aclnode = list_next(&aclp->z_acl, aclnode)) {
1070 			if (aclnode->z_ace_count == 0)
1071 				continue;
1072 			bcopy(aclnode->z_acldata, start, aclnode->z_size);
1073 			start = (caddr_t)start + aclnode->z_size;
1074 		}
1075 	}
1076 
1077 	/*
1078 	 * If Old version then swap count/bytes to match old
1079 	 * layout of znode_acl_phys_t.
1080 	 */
1081 	if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) {
1082 		zphys->zp_acl.z_acl_size = aclp->z_acl_count;
1083 		zphys->zp_acl.z_acl_count = aclp->z_acl_bytes;
1084 	} else {
1085 		zphys->zp_acl.z_acl_size = aclp->z_acl_bytes;
1086 		zphys->zp_acl.z_acl_count = aclp->z_acl_count;
1087 	}
1088 
1089 	zphys->zp_acl.z_acl_version = aclp->z_version;
1090 
1091 	/*
1092 	 * Replace ACL wide bits, but first clear them.
1093 	 */
1094 	zp->z_phys->zp_flags &= ~ZFS_ACL_WIDE_FLAGS;
1095 
1096 	zp->z_phys->zp_flags |= aclp->z_hints;
1097 
1098 	if (ace_trivial_common(aclp, 0, zfs_ace_walk) == 0)
1099 		zp->z_phys->zp_flags |= ZFS_ACL_TRIVIAL;
1100 
1101 	zfs_time_stamper_locked(zp, STATE_CHANGED, tx);
1102 	return (0);
1103 }
1104 
1105 /*
1106  * Update access mask for prepended ACE
1107  *
1108  * This applies the "groupmask" value for aclmode property.
1109  */
1110 static void
1111 zfs_acl_prepend_fixup(zfs_acl_t *aclp, void  *acep, void  *origacep,
1112     mode_t mode, uint64_t owner)
1113 {
1114 	int	rmask, wmask, xmask;
1115 	int	user_ace;
1116 	uint16_t aceflags;
1117 	uint32_t origmask, acepmask;
1118 	uint64_t fuid;
1119 
1120 	aceflags = aclp->z_ops.ace_flags_get(acep);
1121 	fuid = aclp->z_ops.ace_who_get(acep);
1122 	origmask = aclp->z_ops.ace_mask_get(origacep);
1123 	acepmask = aclp->z_ops.ace_mask_get(acep);
1124 
1125 	user_ace = (!(aceflags &
1126 	    (ACE_OWNER|ACE_GROUP|ACE_IDENTIFIER_GROUP)));
1127 
1128 	if (user_ace && (fuid == owner)) {
1129 		rmask = S_IRUSR;
1130 		wmask = S_IWUSR;
1131 		xmask = S_IXUSR;
1132 	} else {
1133 		rmask = S_IRGRP;
1134 		wmask = S_IWGRP;
1135 		xmask = S_IXGRP;
1136 	}
1137 
1138 	if (origmask & ACE_READ_DATA) {
1139 		if (mode & rmask) {
1140 			acepmask &= ~ACE_READ_DATA;
1141 		} else {
1142 			acepmask |= ACE_READ_DATA;
1143 		}
1144 	}
1145 
1146 	if (origmask & ACE_WRITE_DATA) {
1147 		if (mode & wmask) {
1148 			acepmask &= ~ACE_WRITE_DATA;
1149 		} else {
1150 			acepmask |= ACE_WRITE_DATA;
1151 		}
1152 	}
1153 
1154 	if (origmask & ACE_APPEND_DATA) {
1155 		if (mode & wmask) {
1156 			acepmask &= ~ACE_APPEND_DATA;
1157 		} else {
1158 			acepmask |= ACE_APPEND_DATA;
1159 		}
1160 	}
1161 
1162 	if (origmask & ACE_EXECUTE) {
1163 		if (mode & xmask) {
1164 			acepmask &= ~ACE_EXECUTE;
1165 		} else {
1166 			acepmask |= ACE_EXECUTE;
1167 		}
1168 	}
1169 	aclp->z_ops.ace_mask_set(acep, acepmask);
1170 }
1171 
1172 /*
1173  * Apply mode to canonical six ACEs.
1174  */
1175 static void
1176 zfs_acl_fixup_canonical_six(zfs_acl_t *aclp, mode_t mode)
1177 {
1178 	zfs_acl_node_t *aclnode = list_tail(&aclp->z_acl);
1179 	void	*acep;
1180 	int	maskoff = aclp->z_ops.ace_mask_off();
1181 	size_t abstract_size = aclp->z_ops.ace_abstract_size();
1182 
1183 	ASSERT(aclnode != NULL);
1184 
1185 	acep = (void *)((caddr_t)aclnode->z_acldata +
1186 	    aclnode->z_size - (abstract_size * 6));
1187 
1188 	/*
1189 	 * Fixup final ACEs to match the mode
1190 	 */
1191 
1192 	adjust_ace_pair_common(acep, maskoff, abstract_size,
1193 	    (mode & 0700) >> 6);	/* owner@ */
1194 
1195 	acep = (caddr_t)acep + (abstract_size * 2);
1196 
1197 	adjust_ace_pair_common(acep, maskoff, abstract_size,
1198 	    (mode & 0070) >> 3);	/* group@ */
1199 
1200 	acep = (caddr_t)acep + (abstract_size * 2);
1201 	adjust_ace_pair_common(acep, maskoff,
1202 	    abstract_size, mode);	/* everyone@ */
1203 }
1204 
1205 
1206 static int
1207 zfs_acl_ace_match(zfs_acl_t *aclp, void *acep, int allow_deny,
1208     int entry_type, int accessmask)
1209 {
1210 	uint32_t mask = aclp->z_ops.ace_mask_get(acep);
1211 	uint16_t type = aclp->z_ops.ace_type_get(acep);
1212 	uint16_t flags = aclp->z_ops.ace_flags_get(acep);
1213 
1214 	return (mask == accessmask && type == allow_deny &&
1215 	    ((flags & ACE_TYPE_FLAGS) == entry_type));
1216 }
1217 
1218 /*
1219  * Can prepended ACE be reused?
1220  */
1221 static int
1222 zfs_reuse_deny(zfs_acl_t *aclp, void *acep, void *prevacep)
1223 {
1224 	int okay_masks;
1225 	uint16_t prevtype;
1226 	uint16_t prevflags;
1227 	uint16_t flags;
1228 	uint32_t mask, prevmask;
1229 
1230 	if (prevacep == NULL)
1231 		return (B_FALSE);
1232 
1233 	prevtype = aclp->z_ops.ace_type_get(prevacep);
1234 	prevflags = aclp->z_ops.ace_flags_get(prevacep);
1235 	flags = aclp->z_ops.ace_flags_get(acep);
1236 	mask = aclp->z_ops.ace_mask_get(acep);
1237 	prevmask = aclp->z_ops.ace_mask_get(prevacep);
1238 
1239 	if (prevtype != DENY)
1240 		return (B_FALSE);
1241 
1242 	if (prevflags != (flags & ACE_IDENTIFIER_GROUP))
1243 		return (B_FALSE);
1244 
1245 	okay_masks = (mask & OKAY_MASK_BITS);
1246 
1247 	if (prevmask & ~okay_masks)
1248 		return (B_FALSE);
1249 
1250 	return (B_TRUE);
1251 }
1252 
1253 
1254 /*
1255  * Insert new ACL node into chain of zfs_acl_node_t's
1256  *
1257  * This will result in two possible results.
1258  * 1. If the ACL is currently just a single zfs_acl_node and
1259  *    we are prepending the entry then current acl node will have
1260  *    a new node inserted above it.
1261  *
1262  * 2. If we are inserting in the middle of current acl node then
1263  *    the current node will be split in two and new node will be inserted
1264  *    in between the two split nodes.
1265  */
1266 static zfs_acl_node_t *
1267 zfs_acl_ace_insert(zfs_acl_t *aclp, void  *acep)
1268 {
1269 	zfs_acl_node_t 	*newnode;
1270 	zfs_acl_node_t 	*trailernode = NULL;
1271 	zfs_acl_node_t 	*currnode = zfs_acl_curr_node(aclp);
1272 	int		curr_idx = aclp->z_curr_node->z_ace_idx;
1273 	int		trailer_count;
1274 	size_t		oldsize;
1275 
1276 	newnode = zfs_acl_node_alloc(aclp->z_ops.ace_size(acep));
1277 	newnode->z_ace_count = 1;
1278 
1279 	oldsize = currnode->z_size;
1280 
1281 	if (curr_idx != 1) {
1282 		trailernode = zfs_acl_node_alloc(0);
1283 		trailernode->z_acldata = acep;
1284 
1285 		trailer_count = currnode->z_ace_count - curr_idx + 1;
1286 		currnode->z_ace_count = curr_idx - 1;
1287 		currnode->z_size = (caddr_t)acep - (caddr_t)currnode->z_acldata;
1288 		trailernode->z_size = oldsize - currnode->z_size;
1289 		trailernode->z_ace_count = trailer_count;
1290 	}
1291 
1292 	aclp->z_acl_count += 1;
1293 	aclp->z_acl_bytes += aclp->z_ops.ace_size(acep);
1294 
1295 	if (curr_idx == 1)
1296 		list_insert_before(&aclp->z_acl, currnode, newnode);
1297 	else
1298 		list_insert_after(&aclp->z_acl, currnode, newnode);
1299 	if (trailernode) {
1300 		list_insert_after(&aclp->z_acl, newnode, trailernode);
1301 		aclp->z_curr_node = trailernode;
1302 		trailernode->z_ace_idx = 1;
1303 	}
1304 
1305 	return (newnode);
1306 }
1307 
1308 /*
1309  * Prepend deny ACE
1310  */
1311 static void *
1312 zfs_acl_prepend_deny(znode_t *zp, zfs_acl_t *aclp, void *acep,
1313     mode_t mode)
1314 {
1315 	zfs_acl_node_t *aclnode;
1316 	void  *newacep;
1317 	uint64_t fuid;
1318 	uint16_t flags;
1319 
1320 	aclnode = zfs_acl_ace_insert(aclp, acep);
1321 	newacep = aclnode->z_acldata;
1322 	fuid = aclp->z_ops.ace_who_get(acep);
1323 	flags = aclp->z_ops.ace_flags_get(acep);
1324 	zfs_set_ace(aclp, newacep, 0, DENY, fuid, (flags & ACE_TYPE_FLAGS));
1325 	zfs_acl_prepend_fixup(aclp, newacep, acep, mode, zp->z_phys->zp_uid);
1326 
1327 	return (newacep);
1328 }
1329 
1330 /*
1331  * Split an inherited ACE into inherit_only ACE
1332  * and original ACE with inheritance flags stripped off.
1333  */
1334 static void
1335 zfs_acl_split_ace(zfs_acl_t *aclp, zfs_ace_hdr_t *acep)
1336 {
1337 	zfs_acl_node_t *aclnode;
1338 	zfs_acl_node_t *currnode;
1339 	void  *newacep;
1340 	uint16_t type, flags;
1341 	uint32_t mask;
1342 	uint64_t fuid;
1343 
1344 	type = aclp->z_ops.ace_type_get(acep);
1345 	flags = aclp->z_ops.ace_flags_get(acep);
1346 	mask = aclp->z_ops.ace_mask_get(acep);
1347 	fuid = aclp->z_ops.ace_who_get(acep);
1348 
1349 	aclnode = zfs_acl_ace_insert(aclp, acep);
1350 	newacep = aclnode->z_acldata;
1351 
1352 	aclp->z_ops.ace_type_set(newacep, type);
1353 	aclp->z_ops.ace_flags_set(newacep, flags | ACE_INHERIT_ONLY_ACE);
1354 	aclp->z_ops.ace_mask_set(newacep, mask);
1355 	aclp->z_ops.ace_type_set(newacep, type);
1356 	aclp->z_ops.ace_who_set(newacep, fuid);
1357 	aclp->z_next_ace = acep;
1358 	flags &= ~ALL_INHERIT;
1359 	aclp->z_ops.ace_flags_set(acep, flags);
1360 	currnode = zfs_acl_curr_node(aclp);
1361 	ASSERT(currnode->z_ace_idx >= 1);
1362 	currnode->z_ace_idx -= 1;
1363 }
1364 
1365 /*
1366  * Are ACES started at index i, the canonical six ACES?
1367  */
1368 static int
1369 zfs_have_canonical_six(zfs_acl_t *aclp)
1370 {
1371 	void *acep;
1372 	zfs_acl_node_t *aclnode = list_tail(&aclp->z_acl);
1373 	int		i = 0;
1374 	size_t abstract_size = aclp->z_ops.ace_abstract_size();
1375 
1376 	ASSERT(aclnode != NULL);
1377 
1378 	if (aclnode->z_ace_count < 6)
1379 		return (0);
1380 
1381 	acep = (void *)((caddr_t)aclnode->z_acldata +
1382 	    aclnode->z_size - (aclp->z_ops.ace_abstract_size() * 6));
1383 
1384 	if ((zfs_acl_ace_match(aclp, (caddr_t)acep + (abstract_size * i++),
1385 	    DENY, ACE_OWNER, 0) &&
1386 	    zfs_acl_ace_match(aclp, (caddr_t)acep + (abstract_size * i++),
1387 	    ALLOW, ACE_OWNER, OWNER_ALLOW_MASK) &&
1388 	    zfs_acl_ace_match(aclp, (caddr_t)acep + (abstract_size * i++), DENY,
1389 	    OWNING_GROUP, 0) && zfs_acl_ace_match(aclp, (caddr_t)acep +
1390 	    (abstract_size * i++),
1391 	    ALLOW, OWNING_GROUP, 0) &&
1392 	    zfs_acl_ace_match(aclp, (caddr_t)acep + (abstract_size * i++),
1393 	    DENY, ACE_EVERYONE, EVERYONE_DENY_MASK) &&
1394 	    zfs_acl_ace_match(aclp, (caddr_t)acep + (abstract_size * i++),
1395 	    ALLOW, ACE_EVERYONE, EVERYONE_ALLOW_MASK))) {
1396 		return (1);
1397 	} else {
1398 		return (0);
1399 	}
1400 }
1401 
1402 
1403 /*
1404  * Apply step 1g, to group entries
1405  *
1406  * Need to deal with corner case where group may have
1407  * greater permissions than owner.  If so then limit
1408  * group permissions, based on what extra permissions
1409  * group has.
1410  */
1411 static void
1412 zfs_fixup_group_entries(zfs_acl_t *aclp, void *acep, void *prevacep,
1413     mode_t mode)
1414 {
1415 	uint32_t prevmask = aclp->z_ops.ace_mask_get(prevacep);
1416 	uint32_t mask = aclp->z_ops.ace_mask_get(acep);
1417 	uint16_t prevflags = aclp->z_ops.ace_flags_get(prevacep);
1418 	mode_t extramode = (mode >> 3) & 07;
1419 	mode_t ownermode = (mode >> 6);
1420 
1421 	if (prevflags & ACE_IDENTIFIER_GROUP) {
1422 
1423 		extramode &= ~ownermode;
1424 
1425 		if (extramode) {
1426 			if (extramode & S_IROTH) {
1427 				prevmask &= ~ACE_READ_DATA;
1428 				mask &= ~ACE_READ_DATA;
1429 			}
1430 			if (extramode & S_IWOTH) {
1431 				prevmask &= ~(ACE_WRITE_DATA|ACE_APPEND_DATA);
1432 				mask &= ~(ACE_WRITE_DATA|ACE_APPEND_DATA);
1433 			}
1434 			if (extramode & S_IXOTH) {
1435 				prevmask  &= ~ACE_EXECUTE;
1436 				mask &= ~ACE_EXECUTE;
1437 			}
1438 		}
1439 	}
1440 	aclp->z_ops.ace_mask_set(acep, mask);
1441 	aclp->z_ops.ace_mask_set(prevacep, prevmask);
1442 }
1443 
1444 /*
1445  * Apply the chmod algorithm as described
1446  * in PSARC/2002/240
1447  */
1448 static void
1449 zfs_acl_chmod(znode_t *zp, uint64_t mode, zfs_acl_t *aclp)
1450 {
1451 	zfsvfs_t	*zfsvfs = zp->z_zfsvfs;
1452 	void		*acep = NULL, *prevacep = NULL;
1453 	uint64_t	who;
1454 	int 		i;
1455 	int 		entry_type;
1456 	int 		reuse_deny;
1457 	int 		need_canonical_six = 1;
1458 	uint16_t	iflags, type;
1459 	uint32_t	access_mask;
1460 
1461 	ASSERT(MUTEX_HELD(&zp->z_acl_lock));
1462 	ASSERT(MUTEX_HELD(&zp->z_lock));
1463 
1464 	aclp->z_hints = (zp->z_phys->zp_flags & V4_ACL_WIDE_FLAGS);
1465 
1466 	/*
1467 	 * If discard then just discard all ACL nodes which
1468 	 * represent the ACEs.
1469 	 *
1470 	 * New owner@/group@/everone@ ACEs will be added
1471 	 * later.
1472 	 */
1473 	if (zfsvfs->z_acl_mode == ZFS_ACL_DISCARD)
1474 		zfs_acl_release_nodes(aclp);
1475 
1476 	while (acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask,
1477 	    &iflags, &type)) {
1478 
1479 		entry_type = (iflags & ACE_TYPE_FLAGS);
1480 		iflags = (iflags & ALL_INHERIT);
1481 
1482 		if ((type != ALLOW && type != DENY) ||
1483 		    (iflags & ACE_INHERIT_ONLY_ACE)) {
1484 			if (iflags)
1485 				aclp->z_hints |= ZFS_INHERIT_ACE;
1486 			switch (type) {
1487 			case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
1488 			case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
1489 			case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
1490 			case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
1491 				aclp->z_hints |= ZFS_ACL_OBJ_ACE;
1492 				break;
1493 			}
1494 			goto nextace;
1495 		}
1496 
1497 		/*
1498 		 * Need to split ace into two?
1499 		 */
1500 		if ((iflags & (ACE_FILE_INHERIT_ACE|
1501 		    ACE_DIRECTORY_INHERIT_ACE)) &&
1502 		    (!(iflags & ACE_INHERIT_ONLY_ACE))) {
1503 			zfs_acl_split_ace(aclp, acep);
1504 			aclp->z_hints |= ZFS_INHERIT_ACE;
1505 			goto nextace;
1506 		}
1507 
1508 		if (entry_type == ACE_OWNER || entry_type == ACE_EVERYONE ||
1509 		    (entry_type == OWNING_GROUP)) {
1510 			access_mask &= ~OGE_CLEAR;
1511 			aclp->z_ops.ace_mask_set(acep, access_mask);
1512 			goto nextace;
1513 		} else {
1514 			reuse_deny = B_TRUE;
1515 			if (type == ALLOW) {
1516 
1517 				/*
1518 				 * Check preceding ACE if any, to see
1519 				 * if we need to prepend a DENY ACE.
1520 				 * This is only applicable when the acl_mode
1521 				 * property == groupmask.
1522 				 */
1523 				if (zfsvfs->z_acl_mode == ZFS_ACL_GROUPMASK) {
1524 
1525 					reuse_deny = zfs_reuse_deny(aclp, acep,
1526 					    prevacep);
1527 
1528 					if (!reuse_deny) {
1529 						prevacep =
1530 						    zfs_acl_prepend_deny(zp,
1531 						    aclp, acep, mode);
1532 					} else {
1533 						zfs_acl_prepend_fixup(
1534 						    aclp, prevacep,
1535 						    acep, mode,
1536 						    zp->z_phys->zp_uid);
1537 					}
1538 					zfs_fixup_group_entries(aclp, acep,
1539 					    prevacep, mode);
1540 
1541 				}
1542 			}
1543 		}
1544 nextace:
1545 		prevacep = acep;
1546 	}
1547 
1548 	/*
1549 	 * Check out last six aces, if we have six.
1550 	 */
1551 
1552 	if (aclp->z_acl_count >= 6) {
1553 		if (zfs_have_canonical_six(aclp)) {
1554 			need_canonical_six = 0;
1555 		}
1556 	}
1557 
1558 	if (need_canonical_six) {
1559 		size_t abstract_size = aclp->z_ops.ace_abstract_size();
1560 		void *zacep;
1561 		zfs_acl_node_t *aclnode =
1562 		    zfs_acl_node_alloc(abstract_size * 6);
1563 
1564 		aclnode->z_size = abstract_size * 6;
1565 		aclnode->z_ace_count = 6;
1566 		aclp->z_acl_bytes += aclnode->z_size;
1567 		list_insert_tail(&aclp->z_acl, aclnode);
1568 
1569 		zacep = aclnode->z_acldata;
1570 
1571 		i = 0;
1572 		zfs_set_ace(aclp, (caddr_t)zacep + (abstract_size * i++),
1573 		    0, DENY, -1, ACE_OWNER);
1574 		zfs_set_ace(aclp, (caddr_t)zacep + (abstract_size * i++),
1575 		    OWNER_ALLOW_MASK, ALLOW, -1, ACE_OWNER);
1576 		zfs_set_ace(aclp, (caddr_t)zacep + (abstract_size * i++), 0,
1577 		    DENY, -1, OWNING_GROUP);
1578 		zfs_set_ace(aclp, (caddr_t)zacep + (abstract_size * i++), 0,
1579 		    ALLOW, -1, OWNING_GROUP);
1580 		zfs_set_ace(aclp, (caddr_t)zacep + (abstract_size * i++),
1581 		    EVERYONE_DENY_MASK, DENY, -1, ACE_EVERYONE);
1582 		zfs_set_ace(aclp, (caddr_t)zacep + (abstract_size * i++),
1583 		    EVERYONE_ALLOW_MASK, ALLOW, -1, ACE_EVERYONE);
1584 		aclp->z_acl_count += 6;
1585 	}
1586 
1587 	zfs_acl_fixup_canonical_six(aclp, mode);
1588 }
1589 
1590 int
1591 zfs_acl_chmod_setattr(znode_t *zp, zfs_acl_t **aclp, uint64_t mode)
1592 {
1593 	int error;
1594 
1595 	mutex_enter(&zp->z_lock);
1596 	mutex_enter(&zp->z_acl_lock);
1597 	*aclp = NULL;
1598 	error = zfs_acl_node_read(zp, aclp, B_TRUE);
1599 	if (error == 0)
1600 		zfs_acl_chmod(zp, mode, *aclp);
1601 	mutex_exit(&zp->z_acl_lock);
1602 	mutex_exit(&zp->z_lock);
1603 	return (error);
1604 }
1605 
1606 /*
1607  * strip off write_owner and write_acl
1608  */
1609 static void
1610 zfs_restricted_update(zfsvfs_t *zfsvfs, zfs_acl_t *aclp, void *acep)
1611 {
1612 	uint32_t mask = aclp->z_ops.ace_mask_get(acep);
1613 
1614 	if ((zfsvfs->z_acl_inherit == ZFS_ACL_RESTRICTED) &&
1615 	    (aclp->z_ops.ace_type_get(acep) == ALLOW)) {
1616 		mask &= ~RESTRICTED_CLEAR;
1617 		aclp->z_ops.ace_mask_set(acep, mask);
1618 	}
1619 }
1620 
1621 /*
1622  * Should ACE be inherited?
1623  */
1624 static int
1625 zfs_ace_can_use(znode_t *zp, uint16_t acep_flags)
1626 {
1627 	int vtype = ZTOV(zp)->v_type;
1628 	int	iflags = (acep_flags & 0xf);
1629 
1630 	if ((vtype == VDIR) && (iflags & ACE_DIRECTORY_INHERIT_ACE))
1631 		return (1);
1632 	else if (iflags & ACE_FILE_INHERIT_ACE)
1633 		return (!((vtype == VDIR) &&
1634 		    (iflags & ACE_NO_PROPAGATE_INHERIT_ACE)));
1635 	return (0);
1636 }
1637 
1638 /*
1639  * inherit inheritable ACEs from parent
1640  */
1641 static zfs_acl_t *
1642 zfs_acl_inherit(znode_t *zp, zfs_acl_t *paclp, boolean_t *need_chmod)
1643 {
1644 	zfsvfs_t	*zfsvfs = zp->z_zfsvfs;
1645 	void		*pacep;
1646 	void		*acep, *acep2;
1647 	zfs_acl_node_t  *aclnode, *aclnode2;
1648 	zfs_acl_t	*aclp = NULL;
1649 	uint64_t	who;
1650 	uint32_t	access_mask;
1651 	uint16_t	iflags, newflags, type;
1652 	size_t		ace_size;
1653 	void		*data1, *data2;
1654 	size_t		data1sz, data2sz;
1655 	enum vtype	vntype = ZTOV(zp)->v_type;
1656 
1657 	*need_chmod = B_TRUE;
1658 	pacep = NULL;
1659 	aclp = zfs_acl_alloc(zfs_acl_version_zp(zp));
1660 	if (zfsvfs->z_acl_inherit != ZFS_ACL_DISCARD) {
1661 		while (pacep = zfs_acl_next_ace(paclp, pacep, &who,
1662 		    &access_mask, &iflags, &type)) {
1663 
1664 			if (zfsvfs->z_acl_inherit == ZFS_ACL_NOALLOW &&
1665 			    type == ALLOW)
1666 				continue;
1667 
1668 			ace_size = aclp->z_ops.ace_size(pacep);
1669 
1670 			if (!zfs_ace_can_use(zp, iflags))
1671 				continue;
1672 
1673 			/*
1674 			 * If owner@, group@, or everyone@ inheritable
1675 			 * then zfs_acl_chmod() isn't needed.
1676 			 */
1677 			if (zfsvfs->z_acl_inherit ==
1678 			    ZFS_ACL_PASSTHROUGH &&
1679 			    ((iflags & (ACE_OWNER|ACE_EVERYONE)) ||
1680 			    ((iflags & OWNING_GROUP) ==
1681 			    OWNING_GROUP)) && (vntype == VREG ||
1682 			    (vntype == VDIR &&
1683 			    (iflags & ACE_DIRECTORY_INHERIT_ACE))))
1684 				*need_chmod = B_FALSE;
1685 
1686 			aclnode = zfs_acl_node_alloc(ace_size);
1687 			list_insert_tail(&aclp->z_acl, aclnode);
1688 			acep = aclnode->z_acldata;
1689 			zfs_set_ace(aclp, acep, access_mask, type,
1690 			    who, iflags|ACE_INHERITED_ACE);
1691 
1692 			/*
1693 			 * Copy special opaque data if any
1694 			 */
1695 			if ((data1sz = paclp->z_ops.ace_data(pacep,
1696 			    &data1)) != 0) {
1697 				VERIFY((data2sz = aclp->z_ops.ace_data(acep,
1698 				    &data2)) == data1sz);
1699 				bcopy(data1, data2, data2sz);
1700 			}
1701 			aclp->z_acl_count++;
1702 			aclnode->z_ace_count++;
1703 			aclp->z_acl_bytes += aclnode->z_size;
1704 			newflags = aclp->z_ops.ace_flags_get(acep);
1705 
1706 			if (vntype == VDIR)
1707 				aclp->z_hints |= ZFS_INHERIT_ACE;
1708 
1709 			if ((iflags & ACE_NO_PROPAGATE_INHERIT_ACE) ||
1710 			    (vntype != VDIR)) {
1711 				newflags &= ~ALL_INHERIT;
1712 				aclp->z_ops.ace_flags_set(acep,
1713 				    newflags|ACE_INHERITED_ACE);
1714 				zfs_restricted_update(zfsvfs, aclp, acep);
1715 				continue;
1716 			}
1717 
1718 			ASSERT(vntype == VDIR);
1719 
1720 			newflags = aclp->z_ops.ace_flags_get(acep);
1721 			if ((iflags & (ACE_FILE_INHERIT_ACE |
1722 			    ACE_DIRECTORY_INHERIT_ACE)) !=
1723 			    ACE_FILE_INHERIT_ACE) {
1724 				aclnode2 = zfs_acl_node_alloc(ace_size);
1725 				list_insert_tail(&aclp->z_acl, aclnode2);
1726 				acep2 = aclnode2->z_acldata;
1727 				zfs_set_ace(aclp, acep2,
1728 				    access_mask, type, who,
1729 				    iflags|ACE_INHERITED_ACE);
1730 				newflags |= ACE_INHERIT_ONLY_ACE;
1731 				aclp->z_ops.ace_flags_set(acep, newflags);
1732 				newflags &= ~ALL_INHERIT;
1733 				aclp->z_ops.ace_flags_set(acep2,
1734 				    newflags|ACE_INHERITED_ACE);
1735 
1736 				/*
1737 				 * Copy special opaque data if any
1738 				 */
1739 				if ((data1sz = aclp->z_ops.ace_data(acep,
1740 				    &data1)) != 0) {
1741 					VERIFY((data2sz =
1742 					    aclp->z_ops.ace_data(acep2,
1743 					    &data2)) == data1sz);
1744 					bcopy(data1, data2, data1sz);
1745 				}
1746 				aclp->z_acl_count++;
1747 				aclnode2->z_ace_count++;
1748 				aclp->z_acl_bytes += aclnode->z_size;
1749 				zfs_restricted_update(zfsvfs, aclp, acep2);
1750 			} else {
1751 				newflags |= ACE_INHERIT_ONLY_ACE;
1752 				aclp->z_ops.ace_flags_set(acep,
1753 				    newflags|ACE_INHERITED_ACE);
1754 			}
1755 		}
1756 	}
1757 	return (aclp);
1758 }
1759 
1760 /*
1761  * Create file system object initial permissions
1762  * including inheritable ACEs.
1763  */
1764 void
1765 zfs_perm_init(znode_t *zp, znode_t *parent, int flag,
1766     vattr_t *vap, dmu_tx_t *tx, cred_t *cr,
1767     zfs_acl_t *setaclp, zfs_fuid_info_t **fuidp)
1768 {
1769 	uint64_t	mode, fuid, fgid;
1770 	int		error;
1771 	zfsvfs_t	*zfsvfs = zp->z_zfsvfs;
1772 	zfs_acl_t	*aclp = NULL;
1773 	zfs_acl_t	*paclp;
1774 	xvattr_t	*xvap = (xvattr_t *)vap;
1775 	gid_t		gid;
1776 	boolean_t	need_chmod = B_TRUE;
1777 
1778 	if (setaclp)
1779 		aclp = setaclp;
1780 
1781 	mode = MAKEIMODE(vap->va_type, vap->va_mode);
1782 
1783 	/*
1784 	 * Determine uid and gid.
1785 	 */
1786 	if ((flag & (IS_ROOT_NODE | IS_REPLAY)) ||
1787 	    ((flag & IS_XATTR) && (vap->va_type == VDIR))) {
1788 		fuid = zfs_fuid_create(zfsvfs, vap->va_uid, cr,
1789 		    ZFS_OWNER, tx, fuidp);
1790 		fgid = zfs_fuid_create(zfsvfs, vap->va_gid, cr,
1791 		    ZFS_GROUP, tx, fuidp);
1792 		gid = vap->va_gid;
1793 	} else {
1794 		fuid = zfs_fuid_create_cred(zfsvfs, ZFS_OWNER, tx, cr, fuidp);
1795 		fgid = 0;
1796 		if (vap->va_mask & AT_GID)  {
1797 			fgid = zfs_fuid_create(zfsvfs, vap->va_gid, cr,
1798 			    ZFS_GROUP, tx, fuidp);
1799 			gid = vap->va_gid;
1800 			if (fgid != parent->z_phys->zp_gid &&
1801 			    !groupmember(vap->va_gid, cr) &&
1802 			    secpolicy_vnode_create_gid(cr) != 0)
1803 				fgid = 0;
1804 		}
1805 		if (fgid == 0) {
1806 			if (parent->z_phys->zp_mode & S_ISGID) {
1807 				fgid = parent->z_phys->zp_gid;
1808 				gid = zfs_fuid_map_id(zfsvfs, fgid,
1809 				    cr, ZFS_GROUP);
1810 			} else {
1811 				fgid = zfs_fuid_create_cred(zfsvfs,
1812 				    ZFS_GROUP, tx, cr, fuidp);
1813 				gid = crgetgid(cr);
1814 			}
1815 		}
1816 	}
1817 
1818 	/*
1819 	 * If we're creating a directory, and the parent directory has the
1820 	 * set-GID bit set, set in on the new directory.
1821 	 * Otherwise, if the user is neither privileged nor a member of the
1822 	 * file's new group, clear the file's set-GID bit.
1823 	 */
1824 
1825 	if ((parent->z_phys->zp_mode & S_ISGID) && (vap->va_type == VDIR)) {
1826 		mode |= S_ISGID;
1827 	} else {
1828 		if ((mode & S_ISGID) &&
1829 		    secpolicy_vnode_setids_setgids(cr, gid) != 0)
1830 			mode &= ~S_ISGID;
1831 	}
1832 
1833 	zp->z_phys->zp_uid = fuid;
1834 	zp->z_phys->zp_gid = fgid;
1835 	zp->z_phys->zp_mode = mode;
1836 
1837 	if (aclp == NULL) {
1838 		mutex_enter(&parent->z_lock);
1839 		if ((ZTOV(parent)->v_type == VDIR &&
1840 		    parent->z_phys->zp_flags & ZFS_INHERIT_ACE)) {
1841 			mutex_enter(&parent->z_acl_lock);
1842 			VERIFY(0 == zfs_acl_node_read(parent, &paclp, B_FALSE));
1843 			mutex_exit(&parent->z_acl_lock);
1844 			aclp = zfs_acl_inherit(zp, paclp, &need_chmod);
1845 			zfs_acl_free(paclp);
1846 		} else {
1847 			aclp = zfs_acl_alloc(zfs_acl_version_zp(zp));
1848 		}
1849 		mutex_exit(&parent->z_lock);
1850 		mutex_enter(&zp->z_lock);
1851 		mutex_enter(&zp->z_acl_lock);
1852 		if (need_chmod)
1853 			zfs_acl_chmod(zp, mode, aclp);
1854 	} else {
1855 		mutex_enter(&zp->z_lock);
1856 		mutex_enter(&zp->z_acl_lock);
1857 	}
1858 
1859 	/* Force auto_inherit on all new directory objects */
1860 	if (vap->va_type == VDIR)
1861 		aclp->z_hints |= ZFS_ACL_AUTO_INHERIT;
1862 
1863 	error = zfs_aclset_common(zp, aclp, cr, fuidp, tx);
1864 
1865 	/* Set optional attributes if any */
1866 	if (vap->va_mask & AT_XVATTR)
1867 		zfs_xvattr_set(zp, xvap);
1868 
1869 	mutex_exit(&zp->z_lock);
1870 	mutex_exit(&zp->z_acl_lock);
1871 	ASSERT3U(error, ==, 0);
1872 
1873 	if (aclp != setaclp)
1874 		zfs_acl_free(aclp);
1875 }
1876 
1877 /*
1878  * Retrieve a files ACL
1879  */
1880 int
1881 zfs_getacl(znode_t *zp, vsecattr_t *vsecp, boolean_t skipaclchk, cred_t *cr)
1882 {
1883 	zfs_acl_t	*aclp;
1884 	ulong_t		mask;
1885 	int		error;
1886 	int 		count = 0;
1887 	int		largeace = 0;
1888 
1889 	mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT |
1890 	    VSA_ACE_ACLFLAGS | VSA_ACE_ALLTYPES);
1891 
1892 	if (error = zfs_zaccess(zp, ACE_READ_ACL, 0, skipaclchk, cr))
1893 		return (error);
1894 
1895 	if (mask == 0)
1896 		return (ENOSYS);
1897 
1898 	mutex_enter(&zp->z_acl_lock);
1899 
1900 	error = zfs_acl_node_read(zp, &aclp, B_FALSE);
1901 	if (error != 0) {
1902 		mutex_exit(&zp->z_acl_lock);
1903 		return (error);
1904 	}
1905 
1906 	/*
1907 	 * Scan ACL to determine number of ACEs
1908 	 */
1909 	if ((zp->z_phys->zp_flags & ZFS_ACL_OBJ_ACE) &&
1910 	    !(mask & VSA_ACE_ALLTYPES)) {
1911 		void *zacep = NULL;
1912 		uint64_t who;
1913 		uint32_t access_mask;
1914 		uint16_t type, iflags;
1915 
1916 		while (zacep = zfs_acl_next_ace(aclp, zacep,
1917 		    &who, &access_mask, &iflags, &type)) {
1918 			switch (type) {
1919 			case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
1920 			case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
1921 			case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
1922 			case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
1923 				largeace++;
1924 				continue;
1925 			default:
1926 				count++;
1927 			}
1928 		}
1929 		vsecp->vsa_aclcnt = count;
1930 	} else
1931 		count = aclp->z_acl_count;
1932 
1933 	if (mask & VSA_ACECNT) {
1934 		vsecp->vsa_aclcnt = count;
1935 	}
1936 
1937 	if (mask & VSA_ACE) {
1938 		size_t aclsz;
1939 
1940 		zfs_acl_node_t *aclnode = list_head(&aclp->z_acl);
1941 
1942 		aclsz = count * sizeof (ace_t) +
1943 		    sizeof (ace_object_t) * largeace;
1944 
1945 		vsecp->vsa_aclentp = kmem_alloc(aclsz, KM_SLEEP);
1946 		vsecp->vsa_aclentsz = aclsz;
1947 
1948 		if (aclp->z_version == ZFS_ACL_VERSION_FUID)
1949 			zfs_copy_fuid_2_ace(zp->z_zfsvfs, aclp, cr,
1950 			    vsecp->vsa_aclentp, !(mask & VSA_ACE_ALLTYPES));
1951 		else {
1952 			bcopy(aclnode->z_acldata, vsecp->vsa_aclentp,
1953 			    count * sizeof (ace_t));
1954 		}
1955 	}
1956 	if (mask & VSA_ACE_ACLFLAGS) {
1957 		vsecp->vsa_aclflags = 0;
1958 		if (zp->z_phys->zp_flags & ZFS_ACL_DEFAULTED)
1959 			vsecp->vsa_aclflags |= ACL_DEFAULTED;
1960 		if (zp->z_phys->zp_flags & ZFS_ACL_PROTECTED)
1961 			vsecp->vsa_aclflags |= ACL_PROTECTED;
1962 		if (zp->z_phys->zp_flags & ZFS_ACL_AUTO_INHERIT)
1963 			vsecp->vsa_aclflags |= ACL_AUTO_INHERIT;
1964 	}
1965 
1966 	mutex_exit(&zp->z_acl_lock);
1967 
1968 	zfs_acl_free(aclp);
1969 
1970 	return (0);
1971 }
1972 
1973 int
1974 zfs_vsec_2_aclp(zfsvfs_t *zfsvfs, vtype_t obj_type,
1975     vsecattr_t *vsecp, zfs_acl_t **zaclp)
1976 {
1977 	zfs_acl_t *aclp;
1978 	zfs_acl_node_t *aclnode;
1979 	int aclcnt = vsecp->vsa_aclcnt;
1980 	int error;
1981 
1982 	if (vsecp->vsa_aclcnt > MAX_ACL_ENTRIES || vsecp->vsa_aclcnt <= 0)
1983 		return (EINVAL);
1984 
1985 	aclp = zfs_acl_alloc(zfs_acl_version(zfsvfs->z_version));
1986 
1987 	aclp->z_hints = 0;
1988 	aclnode = zfs_acl_node_alloc(aclcnt * sizeof (zfs_object_ace_t));
1989 	if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) {
1990 		if ((error = zfs_copy_ace_2_oldace(obj_type, aclp,
1991 		    (ace_t *)vsecp->vsa_aclentp, aclnode->z_acldata,
1992 		    aclcnt, &aclnode->z_size)) != 0) {
1993 			zfs_acl_free(aclp);
1994 			zfs_acl_node_free(aclnode);
1995 			return (error);
1996 		}
1997 	} else {
1998 		if ((error = zfs_copy_ace_2_fuid(obj_type, aclp,
1999 		    vsecp->vsa_aclentp, aclnode->z_acldata, aclcnt,
2000 		    &aclnode->z_size)) != 0) {
2001 			zfs_acl_free(aclp);
2002 			zfs_acl_node_free(aclnode);
2003 			return (error);
2004 		}
2005 	}
2006 	aclp->z_acl_bytes = aclnode->z_size;
2007 	aclnode->z_ace_count = aclcnt;
2008 	aclp->z_acl_count = aclcnt;
2009 	list_insert_head(&aclp->z_acl, aclnode);
2010 
2011 	/*
2012 	 * If flags are being set then add them to z_hints
2013 	 */
2014 	if (vsecp->vsa_mask & VSA_ACE_ACLFLAGS) {
2015 		if (vsecp->vsa_aclflags & ACL_PROTECTED)
2016 			aclp->z_hints |= ZFS_ACL_PROTECTED;
2017 		if (vsecp->vsa_aclflags & ACL_DEFAULTED)
2018 			aclp->z_hints |= ZFS_ACL_DEFAULTED;
2019 		if (vsecp->vsa_aclflags & ACL_AUTO_INHERIT)
2020 			aclp->z_hints |= ZFS_ACL_AUTO_INHERIT;
2021 	}
2022 
2023 	*zaclp = aclp;
2024 
2025 	return (0);
2026 }
2027 
2028 /*
2029  * Set a files ACL
2030  */
2031 int
2032 zfs_setacl(znode_t *zp, vsecattr_t *vsecp, boolean_t skipaclchk, cred_t *cr)
2033 {
2034 	zfsvfs_t	*zfsvfs = zp->z_zfsvfs;
2035 	zilog_t		*zilog = zfsvfs->z_log;
2036 	ulong_t		mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT);
2037 	dmu_tx_t	*tx;
2038 	int		error;
2039 	zfs_acl_t	*aclp;
2040 	zfs_fuid_info_t	*fuidp = NULL;
2041 
2042 	if (mask == 0)
2043 		return (ENOSYS);
2044 
2045 	if (zp->z_phys->zp_flags & ZFS_IMMUTABLE)
2046 		return (EPERM);
2047 
2048 	if (error = zfs_zaccess(zp, ACE_WRITE_ACL, 0, skipaclchk, cr))
2049 		return (error);
2050 
2051 	error = zfs_vsec_2_aclp(zfsvfs, ZTOV(zp)->v_type, vsecp, &aclp);
2052 	if (error)
2053 		return (error);
2054 
2055 	/*
2056 	 * If ACL wide flags aren't being set then preserve any
2057 	 * existing flags.
2058 	 */
2059 	if (!(vsecp->vsa_mask & VSA_ACE_ACLFLAGS)) {
2060 		aclp->z_hints |= (zp->z_phys->zp_flags & V4_ACL_WIDE_FLAGS);
2061 	}
2062 top:
2063 	if (error = zfs_zaccess(zp, ACE_WRITE_ACL, 0, skipaclchk, cr)) {
2064 		zfs_acl_free(aclp);
2065 		return (error);
2066 	}
2067 
2068 	mutex_enter(&zp->z_lock);
2069 	mutex_enter(&zp->z_acl_lock);
2070 
2071 	tx = dmu_tx_create(zfsvfs->z_os);
2072 	dmu_tx_hold_bonus(tx, zp->z_id);
2073 
2074 	if (zp->z_phys->zp_acl.z_acl_extern_obj) {
2075 		/* Are we upgrading ACL? */
2076 		if (zfsvfs->z_version <= ZPL_VERSION_FUID &&
2077 		    zp->z_phys->zp_acl.z_acl_version ==
2078 		    ZFS_ACL_VERSION_INITIAL) {
2079 			dmu_tx_hold_free(tx,
2080 			    zp->z_phys->zp_acl.z_acl_extern_obj,
2081 			    0, DMU_OBJECT_END);
2082 			dmu_tx_hold_write(tx, DMU_NEW_OBJECT,
2083 			    0, aclp->z_acl_bytes);
2084 		} else {
2085 			dmu_tx_hold_write(tx,
2086 			    zp->z_phys->zp_acl.z_acl_extern_obj,
2087 			    0, aclp->z_acl_bytes);
2088 		}
2089 	} else if (aclp->z_acl_bytes > ZFS_ACE_SPACE) {
2090 		dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0, aclp->z_acl_bytes);
2091 	}
2092 	if (aclp->z_has_fuids) {
2093 		if (zfsvfs->z_fuid_obj == 0) {
2094 			dmu_tx_hold_bonus(tx, DMU_NEW_OBJECT);
2095 			dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0,
2096 			    FUID_SIZE_ESTIMATE(zfsvfs));
2097 			dmu_tx_hold_zap(tx, MASTER_NODE_OBJ, FALSE, NULL);
2098 		} else {
2099 			dmu_tx_hold_bonus(tx, zfsvfs->z_fuid_obj);
2100 			dmu_tx_hold_write(tx, zfsvfs->z_fuid_obj, 0,
2101 			    FUID_SIZE_ESTIMATE(zfsvfs));
2102 		}
2103 	}
2104 
2105 	error = dmu_tx_assign(tx, zfsvfs->z_assign);
2106 	if (error) {
2107 		mutex_exit(&zp->z_acl_lock);
2108 		mutex_exit(&zp->z_lock);
2109 
2110 		if (error == ERESTART && zfsvfs->z_assign == TXG_NOWAIT) {
2111 			dmu_tx_wait(tx);
2112 			dmu_tx_abort(tx);
2113 			goto top;
2114 		}
2115 		dmu_tx_abort(tx);
2116 		zfs_acl_free(aclp);
2117 		return (error);
2118 	}
2119 
2120 	error = zfs_aclset_common(zp, aclp, cr, &fuidp, tx);
2121 	ASSERT(error == 0);
2122 
2123 	zfs_log_acl(zilog, tx, zp, vsecp, fuidp);
2124 
2125 	if (fuidp)
2126 		zfs_fuid_info_free(fuidp);
2127 	zfs_acl_free(aclp);
2128 	dmu_tx_commit(tx);
2129 done:
2130 	mutex_exit(&zp->z_acl_lock);
2131 	mutex_exit(&zp->z_lock);
2132 
2133 	return (error);
2134 }
2135 
2136 /*
2137  * working_mode returns the permissions that were not granted
2138  */
2139 static int
2140 zfs_zaccess_common(znode_t *zp, uint32_t v4_mode, uint32_t *working_mode,
2141     boolean_t *check_privs, boolean_t skipaclchk, cred_t *cr)
2142 {
2143 	zfs_acl_t	*aclp;
2144 	zfsvfs_t	*zfsvfs = zp->z_zfsvfs;
2145 	int		error;
2146 	uid_t		uid = crgetuid(cr);
2147 	uint64_t 	who;
2148 	uint16_t	type, iflags;
2149 	uint16_t	entry_type;
2150 	uint32_t	access_mask;
2151 	uint32_t	deny_mask = 0;
2152 	zfs_ace_hdr_t	*acep = NULL;
2153 	boolean_t	checkit;
2154 	uid_t		fowner;
2155 	uid_t		gowner;
2156 
2157 	/*
2158 	 * Short circuit empty requests
2159 	 */
2160 	if (v4_mode == 0)
2161 		return (0);
2162 
2163 	*check_privs = B_TRUE;
2164 
2165 	if (zfsvfs->z_assign >= TXG_INITIAL) {		/* ZIL replay */
2166 		*working_mode = 0;
2167 		return (0);
2168 	}
2169 
2170 	*working_mode = v4_mode;
2171 
2172 	if ((v4_mode & WRITE_MASK) &&
2173 	    (zp->z_zfsvfs->z_vfs->vfs_flag & VFS_RDONLY) &&
2174 	    (!IS_DEVVP(ZTOV(zp)))) {
2175 		*check_privs = B_FALSE;
2176 		return (EROFS);
2177 	}
2178 
2179 	/*
2180 	 * Only check for READONLY on non-directories.
2181 	 */
2182 	if ((v4_mode & WRITE_MASK_DATA) &&
2183 	    (((ZTOV(zp)->v_type != VDIR) &&
2184 	    (zp->z_phys->zp_flags & (ZFS_READONLY | ZFS_IMMUTABLE))) ||
2185 	    (ZTOV(zp)->v_type == VDIR &&
2186 	    (zp->z_phys->zp_flags & ZFS_IMMUTABLE)))) {
2187 		*check_privs = B_FALSE;
2188 		return (EPERM);
2189 	}
2190 
2191 	if ((v4_mode & (ACE_DELETE | ACE_DELETE_CHILD)) &&
2192 	    (zp->z_phys->zp_flags & ZFS_NOUNLINK)) {
2193 		*check_privs = B_FALSE;
2194 		return (EPERM);
2195 	}
2196 
2197 	if (((v4_mode & (ACE_READ_DATA|ACE_EXECUTE)) &&
2198 	    (zp->z_phys->zp_flags & ZFS_AV_QUARANTINED))) {
2199 		*check_privs = B_FALSE;
2200 		return (EACCES);
2201 	}
2202 
2203 	/*
2204 	 * The caller requested that the ACL check be skipped.  This
2205 	 * would only happen if the caller checked VOP_ACCESS() with a
2206 	 * 32 bit ACE mask and already had the appropriate permissions.
2207 	 */
2208 	if (skipaclchk) {
2209 		*working_mode = 0;
2210 		return (0);
2211 	}
2212 
2213 	zfs_fuid_map_ids(zp, cr, &fowner, &gowner);
2214 
2215 	mutex_enter(&zp->z_acl_lock);
2216 
2217 	error = zfs_acl_node_read(zp, &aclp, B_FALSE);
2218 	if (error != 0) {
2219 		mutex_exit(&zp->z_acl_lock);
2220 		return (error);
2221 	}
2222 
2223 	while (acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask,
2224 	    &iflags, &type)) {
2225 
2226 		if (ZTOV(zp)->v_type == VDIR && (iflags & ACE_INHERIT_ONLY_ACE))
2227 			continue;
2228 
2229 		entry_type = (iflags & ACE_TYPE_FLAGS);
2230 
2231 		checkit = B_FALSE;
2232 
2233 		switch (entry_type) {
2234 		case ACE_OWNER:
2235 			if (uid == fowner)
2236 				checkit = B_TRUE;
2237 			break;
2238 		case OWNING_GROUP:
2239 			who = gowner;
2240 			/*FALLTHROUGH*/
2241 		case ACE_IDENTIFIER_GROUP:
2242 			checkit = zfs_groupmember(zfsvfs, who, cr);
2243 			break;
2244 		case ACE_EVERYONE:
2245 			checkit = B_TRUE;
2246 			break;
2247 
2248 		/* USER Entry */
2249 		default:
2250 			if (entry_type == 0) {
2251 				uid_t newid;
2252 
2253 				newid = zfs_fuid_map_id(zfsvfs, who, cr,
2254 				    ZFS_ACE_USER);
2255 				if (newid != IDMAP_WK_CREATOR_OWNER_UID &&
2256 				    uid == newid)
2257 					checkit = B_TRUE;
2258 				break;
2259 			} else {
2260 				zfs_acl_free(aclp);
2261 				mutex_exit(&zp->z_acl_lock);
2262 				return (EIO);
2263 			}
2264 		}
2265 
2266 		if (checkit) {
2267 			uint32_t mask_matched = (access_mask & *working_mode);
2268 
2269 			if (mask_matched) {
2270 				if (type == DENY)
2271 					deny_mask |= mask_matched;
2272 
2273 				*working_mode &= ~mask_matched;
2274 			}
2275 		}
2276 
2277 		/* Are we done? */
2278 		if (*working_mode == 0)
2279 			break;
2280 	}
2281 
2282 	mutex_exit(&zp->z_acl_lock);
2283 	zfs_acl_free(aclp);
2284 
2285 	/* Put the found 'denies' back on the working mode */
2286 	if (deny_mask) {
2287 		*working_mode |= deny_mask;
2288 		return (EACCES);
2289 	} else if (*working_mode) {
2290 		return (-1);
2291 	}
2292 
2293 	return (0);
2294 }
2295 
2296 static int
2297 zfs_zaccess_append(znode_t *zp, uint32_t *working_mode, boolean_t *check_privs,
2298     cred_t *cr)
2299 {
2300 	if (*working_mode != ACE_WRITE_DATA)
2301 		return (EACCES);
2302 
2303 	return (zfs_zaccess_common(zp, ACE_APPEND_DATA, working_mode,
2304 	    check_privs, B_FALSE, cr));
2305 }
2306 
2307 /*
2308  * Determine whether Access should be granted/denied, invoking least
2309  * priv subsytem when a deny is determined.
2310  */
2311 int
2312 zfs_zaccess(znode_t *zp, int mode, int flags, boolean_t skipaclchk, cred_t *cr)
2313 {
2314 	uint32_t	working_mode;
2315 	int		error;
2316 	int		is_attr;
2317 	zfsvfs_t	*zfsvfs = zp->z_zfsvfs;
2318 	boolean_t 	check_privs;
2319 	znode_t		*xzp;
2320 	znode_t 	*check_zp = zp;
2321 
2322 	is_attr = ((zp->z_phys->zp_flags & ZFS_XATTR) &&
2323 	    (ZTOV(zp)->v_type == VDIR));
2324 
2325 	/*
2326 	 * If attribute then validate against base file
2327 	 */
2328 	if (is_attr) {
2329 		if ((error = zfs_zget(zp->z_zfsvfs,
2330 		    zp->z_phys->zp_parent, &xzp)) != 0)	{
2331 			return (error);
2332 		}
2333 
2334 		check_zp = xzp;
2335 
2336 		/*
2337 		 * fixup mode to map to xattr perms
2338 		 */
2339 
2340 		if (mode & (ACE_WRITE_DATA|ACE_APPEND_DATA)) {
2341 			mode &= ~(ACE_WRITE_DATA|ACE_APPEND_DATA);
2342 			mode |= ACE_WRITE_NAMED_ATTRS;
2343 		}
2344 
2345 		if (mode & (ACE_READ_DATA|ACE_EXECUTE)) {
2346 			mode &= ~(ACE_READ_DATA|ACE_EXECUTE);
2347 			mode |= ACE_READ_NAMED_ATTRS;
2348 		}
2349 	}
2350 
2351 	if ((error = zfs_zaccess_common(check_zp, mode, &working_mode,
2352 	    &check_privs, skipaclchk, cr)) == 0) {
2353 		if (is_attr)
2354 			VN_RELE(ZTOV(xzp));
2355 		return (0);
2356 	}
2357 
2358 	if (error && !check_privs) {
2359 		if (is_attr)
2360 			VN_RELE(ZTOV(xzp));
2361 		return (error);
2362 	}
2363 
2364 	if (error && (flags & V_APPEND)) {
2365 		error = zfs_zaccess_append(zp, &working_mode, &check_privs, cr);
2366 	}
2367 
2368 	if (error && check_privs) {
2369 		uid_t		owner;
2370 		mode_t		checkmode = 0;
2371 
2372 		owner = zfs_fuid_map_id(zfsvfs, check_zp->z_phys->zp_uid, cr,
2373 		    ZFS_OWNER);
2374 
2375 		/*
2376 		 * First check for implicit owner permission on
2377 		 * read_acl/read_attributes
2378 		 */
2379 
2380 		error = 0;
2381 		ASSERT(working_mode != 0);
2382 
2383 		if ((working_mode & (ACE_READ_ACL|ACE_READ_ATTRIBUTES) &&
2384 		    owner == crgetuid(cr)))
2385 			working_mode &= ~(ACE_READ_ACL|ACE_READ_ATTRIBUTES);
2386 
2387 		if (working_mode & (ACE_READ_DATA|ACE_READ_NAMED_ATTRS|
2388 		    ACE_READ_ACL|ACE_READ_ATTRIBUTES))
2389 			checkmode |= VREAD;
2390 		if (working_mode & (ACE_WRITE_DATA|ACE_WRITE_NAMED_ATTRS|
2391 		    ACE_APPEND_DATA|ACE_WRITE_ATTRIBUTES))
2392 			checkmode |= VWRITE;
2393 		if (working_mode & ACE_EXECUTE)
2394 			checkmode |= VEXEC;
2395 
2396 		if (checkmode)
2397 			error = secpolicy_vnode_access(cr, ZTOV(check_zp),
2398 			    owner, checkmode);
2399 
2400 		if (error == 0 && (working_mode & ACE_WRITE_OWNER))
2401 			error = secpolicy_vnode_create_gid(cr);
2402 		if (error == 0 && (working_mode & ACE_WRITE_ACL))
2403 			error = secpolicy_vnode_setdac(cr, owner);
2404 
2405 		if (error == 0 && (working_mode &
2406 		    (ACE_DELETE|ACE_DELETE_CHILD)))
2407 			error = secpolicy_vnode_remove(cr);
2408 
2409 		if (error == 0 && (working_mode & ACE_SYNCHRONIZE))
2410 			error = secpolicy_vnode_owner(cr, owner);
2411 
2412 		if (error == 0) {
2413 			/*
2414 			 * See if any bits other than those already checked
2415 			 * for are still present.  If so then return EACCES
2416 			 */
2417 			if (working_mode & ~(ZFS_CHECKED_MASKS)) {
2418 				error = EACCES;
2419 			}
2420 		}
2421 	}
2422 
2423 	if (is_attr)
2424 		VN_RELE(ZTOV(xzp));
2425 
2426 	return (error);
2427 }
2428 
2429 /*
2430  * Translate traditional unix VREAD/VWRITE/VEXEC mode into
2431  * native ACL format and call zfs_zaccess()
2432  */
2433 int
2434 zfs_zaccess_rwx(znode_t *zp, mode_t mode, int flags, cred_t *cr)
2435 {
2436 	return (zfs_zaccess(zp, zfs_unix_to_v4(mode >> 6), flags, B_FALSE, cr));
2437 }
2438 
2439 /*
2440  * Access function for secpolicy_vnode_setattr
2441  */
2442 int
2443 zfs_zaccess_unix(znode_t *zp, mode_t mode, cred_t *cr)
2444 {
2445 	int v4_mode = zfs_unix_to_v4(mode >> 6);
2446 
2447 	return (zfs_zaccess(zp, v4_mode, 0, B_FALSE, cr));
2448 }
2449 
2450 static int
2451 zfs_delete_final_check(znode_t *zp, znode_t *dzp,
2452     mode_t missing_perms, cred_t *cr)
2453 {
2454 	int error;
2455 	uid_t downer;
2456 	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
2457 
2458 	downer = zfs_fuid_map_id(zfsvfs, dzp->z_phys->zp_uid, cr, ZFS_OWNER);
2459 
2460 	error = secpolicy_vnode_access(cr, ZTOV(dzp), downer, missing_perms);
2461 
2462 	if (error == 0)
2463 		error = zfs_sticky_remove_access(dzp, zp, cr);
2464 
2465 	return (error);
2466 }
2467 
2468 /*
2469  * Determine whether Access should be granted/deny, without
2470  * consulting least priv subsystem.
2471  *
2472  *
2473  * The following chart is the recommended NFSv4 enforcement for
2474  * ability to delete an object.
2475  *
2476  *      -------------------------------------------------------
2477  *      |   Parent Dir  |           Target Object Permissions |
2478  *      |  permissions  |                                     |
2479  *      -------------------------------------------------------
2480  *      |               | ACL Allows | ACL Denies| Delete     |
2481  *      |               |  Delete    |  Delete   | unspecified|
2482  *      -------------------------------------------------------
2483  *      |  ACL Allows   | Permit     | Permit    | Permit     |
2484  *      |  DELETE_CHILD |                                     |
2485  *      -------------------------------------------------------
2486  *      |  ACL Denies   | Permit     | Deny      | Deny       |
2487  *      |  DELETE_CHILD |            |           |            |
2488  *      -------------------------------------------------------
2489  *      | ACL specifies |            |           |            |
2490  *      | only allow    | Permit     | Permit    | Permit     |
2491  *      | write and     |            |           |            |
2492  *      | execute       |            |           |            |
2493  *      -------------------------------------------------------
2494  *      | ACL denies    |            |           |            |
2495  *      | write and     | Permit     | Deny      | Deny       |
2496  *      | execute       |            |           |            |
2497  *      -------------------------------------------------------
2498  *         ^
2499  *         |
2500  *         No search privilege, can't even look up file?
2501  *
2502  */
2503 int
2504 zfs_zaccess_delete(znode_t *dzp, znode_t *zp, cred_t *cr)
2505 {
2506 	uint32_t dzp_working_mode = 0;
2507 	uint32_t zp_working_mode = 0;
2508 	int dzp_error, zp_error;
2509 	mode_t missing_perms;
2510 	boolean_t dzpcheck_privs = B_TRUE;
2511 	boolean_t zpcheck_privs = B_TRUE;
2512 
2513 	/*
2514 	 * We want specific DELETE permissions to
2515 	 * take precedence over WRITE/EXECUTE.  We don't
2516 	 * want an ACL such as this to mess us up.
2517 	 * user:joe:write_data:deny,user:joe:delete:allow
2518 	 *
2519 	 * However, deny permissions may ultimately be overridden
2520 	 * by secpolicy_vnode_access().
2521 	 *
2522 	 * We will ask for all of the necessary permissions and then
2523 	 * look at the working modes from the directory and target object
2524 	 * to determine what was found.
2525 	 */
2526 
2527 	if (zp->z_phys->zp_flags & (ZFS_IMMUTABLE | ZFS_NOUNLINK))
2528 		return (EPERM);
2529 
2530 	/*
2531 	 * First row
2532 	 * If the directory permissions allow the delete, we are done.
2533 	 */
2534 	if ((dzp_error = zfs_zaccess_common(dzp, ACE_DELETE_CHILD,
2535 	    &dzp_working_mode, &dzpcheck_privs, B_FALSE, cr)) == 0)
2536 		return (0);
2537 
2538 	/*
2539 	 * If target object has delete permission then we are done
2540 	 */
2541 	if ((zp_error = zfs_zaccess_common(zp, ACE_DELETE, &zp_working_mode,
2542 	    &zpcheck_privs, B_FALSE, cr)) == 0)
2543 		return (0);
2544 
2545 	ASSERT(dzp_error && zp_error);
2546 
2547 	if (!dzpcheck_privs)
2548 		return (dzp_error);
2549 	if (!zpcheck_privs)
2550 		return (zp_error);
2551 
2552 	/*
2553 	 * Second row
2554 	 *
2555 	 * If directory returns EACCES then delete_child was denied
2556 	 * due to deny delete_child.  In this case send the request through
2557 	 * secpolicy_vnode_remove().  We don't use zfs_delete_final_check()
2558 	 * since that *could* allow the delete based on write/execute permission
2559 	 * and we want delete permissions to override write/execute.
2560 	 */
2561 
2562 	if (dzp_error == EACCES)
2563 		return (secpolicy_vnode_remove(cr));
2564 
2565 	/*
2566 	 * Third Row
2567 	 * only need to see if we have write/execute on directory.
2568 	 */
2569 
2570 	if ((dzp_error = zfs_zaccess_common(dzp, ACE_EXECUTE|ACE_WRITE_DATA,
2571 	    &dzp_working_mode, &dzpcheck_privs, B_FALSE, cr)) == 0)
2572 		return (zfs_sticky_remove_access(dzp, zp, cr));
2573 
2574 	if (!dzpcheck_privs)
2575 		return (dzp_error);
2576 
2577 	/*
2578 	 * Fourth row
2579 	 */
2580 
2581 	missing_perms = (dzp_working_mode & ACE_WRITE_DATA) ? VWRITE : 0;
2582 	missing_perms |= (dzp_working_mode & ACE_EXECUTE) ? VEXEC : 0;
2583 
2584 	ASSERT(missing_perms);
2585 
2586 	return (zfs_delete_final_check(zp, dzp, missing_perms, cr));
2587 
2588 }
2589 
2590 int
2591 zfs_zaccess_rename(znode_t *sdzp, znode_t *szp, znode_t *tdzp,
2592     znode_t *tzp, cred_t *cr)
2593 {
2594 	int add_perm;
2595 	int error;
2596 
2597 	if (szp->z_phys->zp_flags & ZFS_AV_QUARANTINED)
2598 		return (EACCES);
2599 
2600 	add_perm = (ZTOV(szp)->v_type == VDIR) ?
2601 	    ACE_ADD_SUBDIRECTORY : ACE_ADD_FILE;
2602 
2603 	/*
2604 	 * Rename permissions are combination of delete permission +
2605 	 * add file/subdir permission.
2606 	 */
2607 
2608 	/*
2609 	 * first make sure we do the delete portion.
2610 	 *
2611 	 * If that succeeds then check for add_file/add_subdir permissions
2612 	 */
2613 
2614 	if (error = zfs_zaccess_delete(sdzp, szp, cr))
2615 		return (error);
2616 
2617 	/*
2618 	 * If we have a tzp, see if we can delete it?
2619 	 */
2620 	if (tzp) {
2621 		if (error = zfs_zaccess_delete(tdzp, tzp, cr))
2622 			return (error);
2623 	}
2624 
2625 	/*
2626 	 * Now check for add permissions
2627 	 */
2628 	error = zfs_zaccess(tdzp, add_perm, 0, B_FALSE, cr);
2629 
2630 	return (error);
2631 }
2632