1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 * Copyright 2026 Oxide Computer Company 25 */ 26 27 /* Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T */ 28 /* All Rights Reserved */ 29 30 /* 31 * Portions of this source code were derived from Berkeley 4.3 BSD 32 * under license from the Regents of the University of California. 33 */ 34 35 #include <sys/param.h> 36 #include <sys/isa_defs.h> 37 #include <sys/types.h> 38 #include <sys/sysmacros.h> 39 #include <sys/cred.h> 40 #include <sys/user.h> 41 #include <sys/systm.h> 42 #include <sys/errno.h> 43 #include <sys/fcntl.h> 44 #include <sys/pathname.h> 45 #include <sys/var.h> 46 #include <sys/vfs.h> 47 #include <sys/vnode.h> 48 #include <sys/file.h> 49 #include <sys/mode.h> 50 #include <sys/proc.h> 51 #include <sys/uio.h> 52 #include <sys/poll.h> 53 #include <sys/kmem.h> 54 #include <sys/filio.h> 55 #include <sys/cmn_err.h> 56 #include <sys/policy.h> 57 #include <sys/zone.h> 58 59 #include <sys/debug.h> 60 #include <c2/audit.h> 61 #include <fs/fs_subr.h> 62 63 /* 64 * Change current working directory ("."). 65 */ 66 static int chdirec(vnode_t *, int ischroot, int do_traverse); 67 68 static int 69 chdir_common(char *fname, uio_seg_t seg) 70 { 71 vnode_t *vp; 72 int error; 73 int estale_retry = 0; 74 75 lookup: 76 error = lookupname(fname, seg, FOLLOW, NULLVPP, &vp); 77 if (error != 0) { 78 if (error == ESTALE && fs_need_estale_retry(estale_retry++)) 79 goto lookup; 80 return (error); 81 } 82 83 error = chdirec(vp, 0, 1); 84 if (error == ESTALE && fs_need_estale_retry(estale_retry++)) 85 goto lookup; 86 return (error); 87 } 88 89 int 90 chdir(char *fname) 91 { 92 int error = chdir_common(fname, UIO_USERSPACE); 93 94 if (error != 0) 95 return (set_errno(error)); 96 return (0); 97 } 98 99 /* 100 * Kernel-callable version of chdir() taking a kernel-resident path, used to 101 * apply spawn(2) file actions in a spawned child. Unlike chdir(), the error 102 * is returned directly rather than via set_errno(). 103 */ 104 int 105 kchdir(const char *fname) 106 { 107 return (chdir_common((char *)fname, UIO_SYSSPACE)); 108 } 109 110 /* 111 * File-descriptor based version of 'chdir'. 112 */ 113 int 114 fchdir(int fd) 115 { 116 vnode_t *vp; 117 file_t *fp; 118 int error; 119 120 if ((fp = getf(fd)) == NULL) 121 return (set_errno(EBADF)); 122 vp = fp->f_vnode; 123 VN_HOLD(vp); 124 releasef(fd); 125 error = chdirec(vp, 0, 0); 126 if (error) 127 return (set_errno(error)); 128 return (0); 129 } 130 131 /* 132 * Change notion of root ("/") directory. 133 */ 134 int 135 chroot(char *fname) 136 { 137 vnode_t *vp; 138 int error; 139 int estale_retry = 0; 140 141 lookup: 142 if (error = lookupname(fname, UIO_USERSPACE, FOLLOW, NULLVPP, &vp)) { 143 if ((error == ESTALE) && fs_need_estale_retry(estale_retry++)) 144 goto lookup; 145 return (set_errno(error)); 146 } 147 148 error = chdirec(vp, 1, 1); 149 if (error) { 150 if ((error == ESTALE) && fs_need_estale_retry(estale_retry++)) 151 goto lookup; 152 return (set_errno(error)); 153 } 154 return (0); 155 } 156 157 /* 158 * ++++++++++++++++++++++++ 159 * ++ SunOS4.1 Buyback ++ 160 * ++++++++++++++++++++++++ 161 * Change root directory with a user given fd 162 */ 163 int 164 fchroot(int fd) 165 { 166 vnode_t *vp; 167 file_t *fp; 168 int error; 169 170 if ((fp = getf(fd)) == NULL) 171 return (set_errno(EBADF)); 172 vp = fp->f_vnode; 173 VN_HOLD(vp); 174 releasef(fd); 175 error = chdirec(vp, 1, 0); 176 if (error) 177 return (set_errno(error)); 178 return (0); 179 } 180 181 static int 182 chdirec(vnode_t *vp, int ischroot, int do_traverse) 183 { 184 int error; 185 vnode_t *oldvp; 186 proc_t *pp = curproc; 187 vnode_t **vpp; 188 refstr_t *cwd; 189 int newcwd = 1; 190 191 if (vp->v_type != VDIR) { 192 error = ENOTDIR; 193 goto bad; 194 } 195 if (error = VOP_ACCESS(vp, VEXEC, 0, CRED(), NULL)) 196 goto bad; 197 198 /* 199 * The VOP_ACCESS() may have covered 'vp' with a new filesystem, 200 * if 'vp' is an autoFS vnode. Traverse the mountpoint so 201 * that we don't end up with a covered current directory. 202 */ 203 if (vn_mountedvfs(vp) != NULL && do_traverse) { 204 if (error = traverse(&vp)) 205 goto bad; 206 } 207 208 /* 209 * Special chroot semantics: chroot is allowed if privileged 210 * or if the target is really a loopback mount of the root (or 211 * root of the zone) as determined by comparing dev and inode 212 * numbers 213 */ 214 if (ischroot) { 215 struct vattr tattr; 216 struct vattr rattr; 217 vnode_t *zonevp = curproc->p_zone->zone_rootvp; 218 219 tattr.va_mask = AT_FSID|AT_NODEID; 220 if (error = VOP_GETATTR(vp, &tattr, 0, CRED(), NULL)) 221 goto bad; 222 223 rattr.va_mask = AT_FSID|AT_NODEID; 224 if (error = VOP_GETATTR(zonevp, &rattr, 0, CRED(), NULL)) 225 goto bad; 226 227 if ((tattr.va_fsid != rattr.va_fsid || 228 tattr.va_nodeid != rattr.va_nodeid) && 229 (error = secpolicy_chroot(CRED())) != 0) 230 goto bad; 231 232 vpp = &PTOU(pp)->u_rdir; 233 } else { 234 vpp = &PTOU(pp)->u_cdir; 235 } 236 237 /* update abs cwd/root path see c2/audit.c */ 238 if (AU_AUDITING()) 239 audit_chdirec(vp, vpp); 240 241 mutex_enter(&pp->p_lock); 242 /* 243 * This bit of logic prevents us from overwriting u_cwd if we are 244 * changing to the same directory. We set the cwd to NULL so that we 245 * don't try to do the lookup on the next call to getcwd(). 246 */ 247 if (!ischroot && *vpp != NULL && vp != NULL && VN_CMP(*vpp, vp)) 248 newcwd = 0; 249 250 oldvp = *vpp; 251 *vpp = vp; 252 if ((cwd = PTOU(pp)->u_cwd) != NULL && newcwd) 253 PTOU(pp)->u_cwd = NULL; 254 mutex_exit(&pp->p_lock); 255 256 if (cwd && newcwd) 257 refstr_rele(cwd); 258 if (oldvp) 259 VN_RELE(oldvp); 260 return (0); 261 262 bad: 263 VN_RELE(vp); 264 return (error); 265 } 266