xref: /titanic_41/usr/src/uts/common/fs/zfs/zfs_fuid.c (revision 9e37f2b5d225bd6428d62c06655138fc78fd1ac0)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 #include <sys/zfs_context.h>
27 #include <sys/dmu.h>
28 #include <sys/avl.h>
29 #include <sys/zap.h>
30 #include <sys/refcount.h>
31 #include <sys/nvpair.h>
32 #ifdef _KERNEL
33 #include <sys/kidmap.h>
34 #include <sys/sid.h>
35 #include <sys/zfs_vfsops.h>
36 #include <sys/zfs_znode.h>
37 #endif
38 #include <sys/zfs_fuid.h>
39 
40 /*
41  * FUID Domain table(s).
42  *
43  * The FUID table is stored as a packed nvlist of an array
44  * of nvlists which contain an index, domain string and offset
45  *
46  * During file system initialization the nvlist(s) are read and
47  * two AVL trees are created.  One tree is keyed by the index number
48  * and the other by the domain string.  Nodes are never removed from
49  * trees, but new entries may be added.  If a new entry is added then
50  * the zfsvfs->z_fuid_dirty flag is set to true and the caller will then
51  * be responsible for calling zfs_fuid_sync() to sync the changes to disk.
52  *
53  */
54 
55 #define	FUID_IDX	"fuid_idx"
56 #define	FUID_DOMAIN	"fuid_domain"
57 #define	FUID_OFFSET	"fuid_offset"
58 #define	FUID_NVP_ARRAY	"fuid_nvlist"
59 
60 typedef struct fuid_domain {
61 	avl_node_t	f_domnode;
62 	avl_node_t	f_idxnode;
63 	ksiddomain_t	*f_ksid;
64 	uint64_t	f_idx;
65 } fuid_domain_t;
66 
67 static char *nulldomain = "";
68 
69 /*
70  * Compare two indexes.
71  */
72 static int
73 idx_compare(const void *arg1, const void *arg2)
74 {
75 	const fuid_domain_t *node1 = arg1;
76 	const fuid_domain_t *node2 = arg2;
77 
78 	if (node1->f_idx < node2->f_idx)
79 		return (-1);
80 	else if (node1->f_idx > node2->f_idx)
81 		return (1);
82 	return (0);
83 }
84 
85 /*
86  * Compare two domain strings.
87  */
88 static int
89 domain_compare(const void *arg1, const void *arg2)
90 {
91 	const fuid_domain_t *node1 = arg1;
92 	const fuid_domain_t *node2 = arg2;
93 	int val;
94 
95 	val = strcmp(node1->f_ksid->kd_name, node2->f_ksid->kd_name);
96 	if (val == 0)
97 		return (0);
98 	return (val > 0 ? 1 : -1);
99 }
100 
101 void
102 zfs_fuid_avl_tree_create(avl_tree_t *idx_tree, avl_tree_t *domain_tree)
103 {
104 	avl_create(idx_tree, idx_compare,
105 	    sizeof (fuid_domain_t), offsetof(fuid_domain_t, f_idxnode));
106 	avl_create(domain_tree, domain_compare,
107 	    sizeof (fuid_domain_t), offsetof(fuid_domain_t, f_domnode));
108 }
109 
110 /*
111  * load initial fuid domain and idx trees.  This function is used by
112  * both the kernel and zdb.
113  */
114 uint64_t
115 zfs_fuid_table_load(objset_t *os, uint64_t fuid_obj, avl_tree_t *idx_tree,
116     avl_tree_t *domain_tree)
117 {
118 	dmu_buf_t *db;
119 	uint64_t fuid_size;
120 
121 	ASSERT(fuid_obj != 0);
122 	VERIFY(0 == dmu_bonus_hold(os, fuid_obj,
123 	    FTAG, &db));
124 	fuid_size = *(uint64_t *)db->db_data;
125 	dmu_buf_rele(db, FTAG);
126 
127 	if (fuid_size)  {
128 		nvlist_t **fuidnvp;
129 		nvlist_t *nvp = NULL;
130 		uint_t count;
131 		char *packed;
132 		int i;
133 
134 		packed = kmem_alloc(fuid_size, KM_SLEEP);
135 		VERIFY(dmu_read(os, fuid_obj, 0,
136 		    fuid_size, packed, DMU_READ_PREFETCH) == 0);
137 		VERIFY(nvlist_unpack(packed, fuid_size,
138 		    &nvp, 0) == 0);
139 		VERIFY(nvlist_lookup_nvlist_array(nvp, FUID_NVP_ARRAY,
140 		    &fuidnvp, &count) == 0);
141 
142 		for (i = 0; i != count; i++) {
143 			fuid_domain_t *domnode;
144 			char *domain;
145 			uint64_t idx;
146 
147 			VERIFY(nvlist_lookup_string(fuidnvp[i], FUID_DOMAIN,
148 			    &domain) == 0);
149 			VERIFY(nvlist_lookup_uint64(fuidnvp[i], FUID_IDX,
150 			    &idx) == 0);
151 
152 			domnode = kmem_alloc(sizeof (fuid_domain_t), KM_SLEEP);
153 
154 			domnode->f_idx = idx;
155 			domnode->f_ksid = ksid_lookupdomain(domain);
156 			avl_add(idx_tree, domnode);
157 			avl_add(domain_tree, domnode);
158 		}
159 		nvlist_free(nvp);
160 		kmem_free(packed, fuid_size);
161 	}
162 	return (fuid_size);
163 }
164 
165 void
166 zfs_fuid_table_destroy(avl_tree_t *idx_tree, avl_tree_t *domain_tree)
167 {
168 	fuid_domain_t *domnode;
169 	void *cookie;
170 
171 	cookie = NULL;
172 	while (domnode = avl_destroy_nodes(domain_tree, &cookie))
173 		ksiddomain_rele(domnode->f_ksid);
174 
175 	avl_destroy(domain_tree);
176 	cookie = NULL;
177 	while (domnode = avl_destroy_nodes(idx_tree, &cookie))
178 		kmem_free(domnode, sizeof (fuid_domain_t));
179 	avl_destroy(idx_tree);
180 }
181 
182 char *
183 zfs_fuid_idx_domain(avl_tree_t *idx_tree, uint32_t idx)
184 {
185 	fuid_domain_t searchnode, *findnode;
186 	avl_index_t loc;
187 
188 	searchnode.f_idx = idx;
189 
190 	findnode = avl_find(idx_tree, &searchnode, &loc);
191 
192 	return (findnode ? findnode->f_ksid->kd_name : nulldomain);
193 }
194 
195 #ifdef _KERNEL
196 /*
197  * Load the fuid table(s) into memory.
198  */
199 static void
200 zfs_fuid_init(zfsvfs_t *zfsvfs)
201 {
202 	rw_enter(&zfsvfs->z_fuid_lock, RW_WRITER);
203 
204 	if (zfsvfs->z_fuid_loaded) {
205 		rw_exit(&zfsvfs->z_fuid_lock);
206 		return;
207 	}
208 
209 	zfs_fuid_avl_tree_create(&zfsvfs->z_fuid_idx, &zfsvfs->z_fuid_domain);
210 
211 	(void) zap_lookup(zfsvfs->z_os, MASTER_NODE_OBJ,
212 	    ZFS_FUID_TABLES, 8, 1, &zfsvfs->z_fuid_obj);
213 	if (zfsvfs->z_fuid_obj != 0) {
214 		zfsvfs->z_fuid_size = zfs_fuid_table_load(zfsvfs->z_os,
215 		    zfsvfs->z_fuid_obj, &zfsvfs->z_fuid_idx,
216 		    &zfsvfs->z_fuid_domain);
217 	}
218 
219 	zfsvfs->z_fuid_loaded = B_TRUE;
220 	rw_exit(&zfsvfs->z_fuid_lock);
221 }
222 
223 /*
224  * sync out AVL trees to persistent storage.
225  */
226 void
227 zfs_fuid_sync(zfsvfs_t *zfsvfs, dmu_tx_t *tx)
228 {
229 	nvlist_t *nvp;
230 	nvlist_t **fuids;
231 	size_t nvsize = 0;
232 	char *packed;
233 	dmu_buf_t *db;
234 	fuid_domain_t *domnode;
235 	int numnodes;
236 	int i;
237 
238 	if (!zfsvfs->z_fuid_dirty) {
239 		return;
240 	}
241 
242 	rw_enter(&zfsvfs->z_fuid_lock, RW_WRITER);
243 
244 	/*
245 	 * First see if table needs to be created?
246 	 */
247 	if (zfsvfs->z_fuid_obj == 0) {
248 		zfsvfs->z_fuid_obj = dmu_object_alloc(zfsvfs->z_os,
249 		    DMU_OT_FUID, 1 << 14, DMU_OT_FUID_SIZE,
250 		    sizeof (uint64_t), tx);
251 		VERIFY(zap_add(zfsvfs->z_os, MASTER_NODE_OBJ,
252 		    ZFS_FUID_TABLES, sizeof (uint64_t), 1,
253 		    &zfsvfs->z_fuid_obj, tx) == 0);
254 	}
255 
256 	VERIFY(nvlist_alloc(&nvp, NV_UNIQUE_NAME, KM_SLEEP) == 0);
257 
258 	numnodes = avl_numnodes(&zfsvfs->z_fuid_idx);
259 	fuids = kmem_alloc(numnodes * sizeof (void *), KM_SLEEP);
260 	for (i = 0, domnode = avl_first(&zfsvfs->z_fuid_domain); domnode; i++,
261 	    domnode = AVL_NEXT(&zfsvfs->z_fuid_domain, domnode)) {
262 		VERIFY(nvlist_alloc(&fuids[i], NV_UNIQUE_NAME, KM_SLEEP) == 0);
263 		VERIFY(nvlist_add_uint64(fuids[i], FUID_IDX,
264 		    domnode->f_idx) == 0);
265 		VERIFY(nvlist_add_uint64(fuids[i], FUID_OFFSET, 0) == 0);
266 		VERIFY(nvlist_add_string(fuids[i], FUID_DOMAIN,
267 		    domnode->f_ksid->kd_name) == 0);
268 	}
269 	VERIFY(nvlist_add_nvlist_array(nvp, FUID_NVP_ARRAY,
270 	    fuids, numnodes) == 0);
271 	for (i = 0; i != numnodes; i++)
272 		nvlist_free(fuids[i]);
273 	kmem_free(fuids, numnodes * sizeof (void *));
274 	VERIFY(nvlist_size(nvp, &nvsize, NV_ENCODE_XDR) == 0);
275 	packed = kmem_alloc(nvsize, KM_SLEEP);
276 	VERIFY(nvlist_pack(nvp, &packed, &nvsize,
277 	    NV_ENCODE_XDR, KM_SLEEP) == 0);
278 	nvlist_free(nvp);
279 	zfsvfs->z_fuid_size = nvsize;
280 	dmu_write(zfsvfs->z_os, zfsvfs->z_fuid_obj, 0,
281 	    zfsvfs->z_fuid_size, packed, tx);
282 	kmem_free(packed, zfsvfs->z_fuid_size);
283 	VERIFY(0 == dmu_bonus_hold(zfsvfs->z_os, zfsvfs->z_fuid_obj,
284 	    FTAG, &db));
285 	dmu_buf_will_dirty(db, tx);
286 	*(uint64_t *)db->db_data = zfsvfs->z_fuid_size;
287 	dmu_buf_rele(db, FTAG);
288 
289 	zfsvfs->z_fuid_dirty = B_FALSE;
290 	rw_exit(&zfsvfs->z_fuid_lock);
291 }
292 
293 /*
294  * Query domain table for a given domain.
295  *
296  * If domain isn't found and addok is set, it is added to AVL trees and
297  * the zfsvfs->z_fuid_dirty flag will be set to TRUE.  It will then be
298  * necessary for the caller or another thread to detect the dirty table
299  * and sync out the changes.
300  */
301 int
302 zfs_fuid_find_by_domain(zfsvfs_t *zfsvfs, const char *domain,
303     char **retdomain, boolean_t addok)
304 {
305 	fuid_domain_t searchnode, *findnode;
306 	avl_index_t loc;
307 	krw_t rw = RW_READER;
308 
309 	/*
310 	 * If the dummy "nobody" domain then return an index of 0
311 	 * to cause the created FUID to be a standard POSIX id
312 	 * for the user nobody.
313 	 */
314 	if (domain[0] == '\0') {
315 		if (retdomain)
316 			*retdomain = nulldomain;
317 		return (0);
318 	}
319 
320 	searchnode.f_ksid = ksid_lookupdomain(domain);
321 	if (retdomain)
322 		*retdomain = searchnode.f_ksid->kd_name;
323 	if (!zfsvfs->z_fuid_loaded)
324 		zfs_fuid_init(zfsvfs);
325 
326 retry:
327 	rw_enter(&zfsvfs->z_fuid_lock, rw);
328 	findnode = avl_find(&zfsvfs->z_fuid_domain, &searchnode, &loc);
329 
330 	if (findnode) {
331 		rw_exit(&zfsvfs->z_fuid_lock);
332 		ksiddomain_rele(searchnode.f_ksid);
333 		return (findnode->f_idx);
334 	} else if (addok) {
335 		fuid_domain_t *domnode;
336 		uint64_t retidx;
337 
338 		if (rw == RW_READER && !rw_tryupgrade(&zfsvfs->z_fuid_lock)) {
339 			rw_exit(&zfsvfs->z_fuid_lock);
340 			rw = RW_WRITER;
341 			goto retry;
342 		}
343 
344 		domnode = kmem_alloc(sizeof (fuid_domain_t), KM_SLEEP);
345 		domnode->f_ksid = searchnode.f_ksid;
346 
347 		retidx = domnode->f_idx = avl_numnodes(&zfsvfs->z_fuid_idx) + 1;
348 
349 		avl_add(&zfsvfs->z_fuid_domain, domnode);
350 		avl_add(&zfsvfs->z_fuid_idx, domnode);
351 		zfsvfs->z_fuid_dirty = B_TRUE;
352 		rw_exit(&zfsvfs->z_fuid_lock);
353 		return (retidx);
354 	} else {
355 		rw_exit(&zfsvfs->z_fuid_lock);
356 		return (-1);
357 	}
358 }
359 
360 /*
361  * Query domain table by index, returning domain string
362  *
363  * Returns a pointer from an avl node of the domain string.
364  *
365  */
366 const char *
367 zfs_fuid_find_by_idx(zfsvfs_t *zfsvfs, uint32_t idx)
368 {
369 	char *domain;
370 
371 	if (idx == 0 || !zfsvfs->z_use_fuids)
372 		return (NULL);
373 
374 	if (!zfsvfs->z_fuid_loaded)
375 		zfs_fuid_init(zfsvfs);
376 
377 	rw_enter(&zfsvfs->z_fuid_lock, RW_READER);
378 
379 	if (zfsvfs->z_fuid_obj)
380 		domain = zfs_fuid_idx_domain(&zfsvfs->z_fuid_idx, idx);
381 	else
382 		domain = nulldomain;
383 	rw_exit(&zfsvfs->z_fuid_lock);
384 
385 	ASSERT(domain);
386 	return (domain);
387 }
388 
389 void
390 zfs_fuid_map_ids(znode_t *zp, cred_t *cr, uid_t *uidp, uid_t *gidp)
391 {
392 	uint64_t fuid, fgid;
393 	sa_bulk_attr_t bulk[2];
394 	int count = 0;
395 
396 	if (IS_EPHEMERAL(zp->z_uid) || IS_EPHEMERAL(zp->z_gid)) {
397 		SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_UID(zp->z_zfsvfs),
398 		    NULL, &fuid, 8);
399 		SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_GID(zp->z_zfsvfs),
400 		    NULL, &fgid, 8);
401 		VERIFY(0 == sa_bulk_lookup(zp->z_sa_hdl, bulk, count));
402 	}
403 	if (IS_EPHEMERAL(zp->z_uid))
404 		*uidp = zfs_fuid_map_id(zp->z_zfsvfs, zp->z_uid, cr, ZFS_OWNER);
405 	else
406 		*uidp = zp->z_uid;
407 	if (IS_EPHEMERAL(zp->z_gid))
408 		*gidp = zfs_fuid_map_id(zp->z_zfsvfs,
409 		    zp->z_gid, cr, ZFS_GROUP);
410 	else
411 		*gidp = zp->z_gid;
412 }
413 
414 uid_t
415 zfs_fuid_map_id(zfsvfs_t *zfsvfs, uint64_t fuid,
416     cred_t *cr, zfs_fuid_type_t type)
417 {
418 	uint32_t index = FUID_INDEX(fuid);
419 	const char *domain;
420 	uid_t id;
421 
422 	if (index == 0)
423 		return (fuid);
424 
425 	domain = zfs_fuid_find_by_idx(zfsvfs, index);
426 	ASSERT(domain != NULL);
427 
428 	if (type == ZFS_OWNER || type == ZFS_ACE_USER) {
429 		(void) kidmap_getuidbysid(crgetzone(cr), domain,
430 		    FUID_RID(fuid), &id);
431 	} else {
432 		(void) kidmap_getgidbysid(crgetzone(cr), domain,
433 		    FUID_RID(fuid), &id);
434 	}
435 	return (id);
436 }
437 
438 /*
439  * Add a FUID node to the list of fuid's being created for this
440  * ACL
441  *
442  * If ACL has multiple domains, then keep only one copy of each unique
443  * domain.
444  */
445 void
446 zfs_fuid_node_add(zfs_fuid_info_t **fuidpp, const char *domain, uint32_t rid,
447     uint64_t idx, uint64_t id, zfs_fuid_type_t type)
448 {
449 	zfs_fuid_t *fuid;
450 	zfs_fuid_domain_t *fuid_domain;
451 	zfs_fuid_info_t *fuidp;
452 	uint64_t fuididx;
453 	boolean_t found = B_FALSE;
454 
455 	if (*fuidpp == NULL)
456 		*fuidpp = zfs_fuid_info_alloc();
457 
458 	fuidp = *fuidpp;
459 	/*
460 	 * First find fuid domain index in linked list
461 	 *
462 	 * If one isn't found then create an entry.
463 	 */
464 
465 	for (fuididx = 1, fuid_domain = list_head(&fuidp->z_domains);
466 	    fuid_domain; fuid_domain = list_next(&fuidp->z_domains,
467 	    fuid_domain), fuididx++) {
468 		if (idx == fuid_domain->z_domidx) {
469 			found = B_TRUE;
470 			break;
471 		}
472 	}
473 
474 	if (!found) {
475 		fuid_domain = kmem_alloc(sizeof (zfs_fuid_domain_t), KM_SLEEP);
476 		fuid_domain->z_domain = domain;
477 		fuid_domain->z_domidx = idx;
478 		list_insert_tail(&fuidp->z_domains, fuid_domain);
479 		fuidp->z_domain_str_sz += strlen(domain) + 1;
480 		fuidp->z_domain_cnt++;
481 	}
482 
483 	if (type == ZFS_ACE_USER || type == ZFS_ACE_GROUP) {
484 
485 		/*
486 		 * Now allocate fuid entry and add it on the end of the list
487 		 */
488 
489 		fuid = kmem_alloc(sizeof (zfs_fuid_t), KM_SLEEP);
490 		fuid->z_id = id;
491 		fuid->z_domidx = idx;
492 		fuid->z_logfuid = FUID_ENCODE(fuididx, rid);
493 
494 		list_insert_tail(&fuidp->z_fuids, fuid);
495 		fuidp->z_fuid_cnt++;
496 	} else {
497 		if (type == ZFS_OWNER)
498 			fuidp->z_fuid_owner = FUID_ENCODE(fuididx, rid);
499 		else
500 			fuidp->z_fuid_group = FUID_ENCODE(fuididx, rid);
501 	}
502 }
503 
504 /*
505  * Create a file system FUID, based on information in the users cred
506  *
507  * If cred contains KSID_OWNER then it should be used to determine
508  * the uid otherwise cred's uid will be used. By default cred's gid
509  * is used unless it's an ephemeral ID in which case KSID_GROUP will
510  * be used if it exists.
511  */
512 uint64_t
513 zfs_fuid_create_cred(zfsvfs_t *zfsvfs, zfs_fuid_type_t type,
514     cred_t *cr, zfs_fuid_info_t **fuidp)
515 {
516 	uint64_t	idx;
517 	ksid_t		*ksid;
518 	uint32_t	rid;
519 	char 		*kdomain;
520 	const char	*domain;
521 	uid_t		id;
522 
523 	VERIFY(type == ZFS_OWNER || type == ZFS_GROUP);
524 
525 	ksid = crgetsid(cr, (type == ZFS_OWNER) ? KSID_OWNER : KSID_GROUP);
526 
527 	if (!zfsvfs->z_use_fuids || (ksid == NULL)) {
528 		id = (type == ZFS_OWNER) ? crgetuid(cr) : crgetgid(cr);
529 
530 		if (IS_EPHEMERAL(id))
531 			return ((type == ZFS_OWNER) ? UID_NOBODY : GID_NOBODY);
532 
533 		return ((uint64_t)id);
534 	}
535 
536 	/*
537 	 * ksid is present and FUID is supported
538 	 */
539 	id = (type == ZFS_OWNER) ? ksid_getid(ksid) : crgetgid(cr);
540 
541 	if (!IS_EPHEMERAL(id))
542 		return ((uint64_t)id);
543 
544 	if (type == ZFS_GROUP)
545 		id = ksid_getid(ksid);
546 
547 	rid = ksid_getrid(ksid);
548 	domain = ksid_getdomain(ksid);
549 
550 	idx = zfs_fuid_find_by_domain(zfsvfs, domain, &kdomain, B_TRUE);
551 
552 	zfs_fuid_node_add(fuidp, kdomain, rid, idx, id, type);
553 
554 	return (FUID_ENCODE(idx, rid));
555 }
556 
557 /*
558  * Create a file system FUID for an ACL ace
559  * or a chown/chgrp of the file.
560  * This is similar to zfs_fuid_create_cred, except that
561  * we can't find the domain + rid information in the
562  * cred.  Instead we have to query Winchester for the
563  * domain and rid.
564  *
565  * During replay operations the domain+rid information is
566  * found in the zfs_fuid_info_t that the replay code has
567  * attached to the zfsvfs of the file system.
568  */
569 uint64_t
570 zfs_fuid_create(zfsvfs_t *zfsvfs, uint64_t id, cred_t *cr,
571     zfs_fuid_type_t type, zfs_fuid_info_t **fuidpp)
572 {
573 	const char *domain;
574 	char *kdomain;
575 	uint32_t fuid_idx = FUID_INDEX(id);
576 	uint32_t rid;
577 	idmap_stat status;
578 	uint64_t idx;
579 	zfs_fuid_t *zfuid = NULL;
580 	zfs_fuid_info_t *fuidp;
581 
582 	/*
583 	 * If POSIX ID, or entry is already a FUID then
584 	 * just return the id
585 	 *
586 	 * We may also be handed an already FUID'ized id via
587 	 * chmod.
588 	 */
589 
590 	if (!zfsvfs->z_use_fuids || !IS_EPHEMERAL(id) || fuid_idx != 0)
591 		return (id);
592 
593 	if (zfsvfs->z_replay) {
594 		fuidp = zfsvfs->z_fuid_replay;
595 
596 		/*
597 		 * If we are passed an ephemeral id, but no
598 		 * fuid_info was logged then return NOBODY.
599 		 * This is most likely a result of idmap service
600 		 * not being available.
601 		 */
602 		if (fuidp == NULL)
603 			return (UID_NOBODY);
604 
605 		switch (type) {
606 		case ZFS_ACE_USER:
607 		case ZFS_ACE_GROUP:
608 			zfuid = list_head(&fuidp->z_fuids);
609 			rid = FUID_RID(zfuid->z_logfuid);
610 			idx = FUID_INDEX(zfuid->z_logfuid);
611 			break;
612 		case ZFS_OWNER:
613 			rid = FUID_RID(fuidp->z_fuid_owner);
614 			idx = FUID_INDEX(fuidp->z_fuid_owner);
615 			break;
616 		case ZFS_GROUP:
617 			rid = FUID_RID(fuidp->z_fuid_group);
618 			idx = FUID_INDEX(fuidp->z_fuid_group);
619 			break;
620 		};
621 		domain = fuidp->z_domain_table[idx -1];
622 	} else {
623 		if (type == ZFS_OWNER || type == ZFS_ACE_USER)
624 			status = kidmap_getsidbyuid(crgetzone(cr), id,
625 			    &domain, &rid);
626 		else
627 			status = kidmap_getsidbygid(crgetzone(cr), id,
628 			    &domain, &rid);
629 
630 		if (status != 0) {
631 			/*
632 			 * When returning nobody we will need to
633 			 * make a dummy fuid table entry for logging
634 			 * purposes.
635 			 */
636 			rid = UID_NOBODY;
637 			domain = nulldomain;
638 		}
639 	}
640 
641 	idx = zfs_fuid_find_by_domain(zfsvfs, domain, &kdomain, B_TRUE);
642 
643 	if (!zfsvfs->z_replay)
644 		zfs_fuid_node_add(fuidpp, kdomain,
645 		    rid, idx, id, type);
646 	else if (zfuid != NULL) {
647 		list_remove(&fuidp->z_fuids, zfuid);
648 		kmem_free(zfuid, sizeof (zfs_fuid_t));
649 	}
650 	return (FUID_ENCODE(idx, rid));
651 }
652 
653 void
654 zfs_fuid_destroy(zfsvfs_t *zfsvfs)
655 {
656 	rw_enter(&zfsvfs->z_fuid_lock, RW_WRITER);
657 	if (!zfsvfs->z_fuid_loaded) {
658 		rw_exit(&zfsvfs->z_fuid_lock);
659 		return;
660 	}
661 	zfs_fuid_table_destroy(&zfsvfs->z_fuid_idx, &zfsvfs->z_fuid_domain);
662 	rw_exit(&zfsvfs->z_fuid_lock);
663 }
664 
665 /*
666  * Allocate zfs_fuid_info for tracking FUIDs created during
667  * zfs_mknode, VOP_SETATTR() or VOP_SETSECATTR()
668  */
669 zfs_fuid_info_t *
670 zfs_fuid_info_alloc(void)
671 {
672 	zfs_fuid_info_t *fuidp;
673 
674 	fuidp = kmem_zalloc(sizeof (zfs_fuid_info_t), KM_SLEEP);
675 	list_create(&fuidp->z_domains, sizeof (zfs_fuid_domain_t),
676 	    offsetof(zfs_fuid_domain_t, z_next));
677 	list_create(&fuidp->z_fuids, sizeof (zfs_fuid_t),
678 	    offsetof(zfs_fuid_t, z_next));
679 	return (fuidp);
680 }
681 
682 /*
683  * Release all memory associated with zfs_fuid_info_t
684  */
685 void
686 zfs_fuid_info_free(zfs_fuid_info_t *fuidp)
687 {
688 	zfs_fuid_t *zfuid;
689 	zfs_fuid_domain_t *zdomain;
690 
691 	while ((zfuid = list_head(&fuidp->z_fuids)) != NULL) {
692 		list_remove(&fuidp->z_fuids, zfuid);
693 		kmem_free(zfuid, sizeof (zfs_fuid_t));
694 	}
695 
696 	if (fuidp->z_domain_table != NULL)
697 		kmem_free(fuidp->z_domain_table,
698 		    (sizeof (char **)) * fuidp->z_domain_cnt);
699 
700 	while ((zdomain = list_head(&fuidp->z_domains)) != NULL) {
701 		list_remove(&fuidp->z_domains, zdomain);
702 		kmem_free(zdomain, sizeof (zfs_fuid_domain_t));
703 	}
704 
705 	kmem_free(fuidp, sizeof (zfs_fuid_info_t));
706 }
707 
708 /*
709  * Check to see if id is a groupmember.  If cred
710  * has ksid info then sidlist is checked first
711  * and if still not found then POSIX groups are checked
712  *
713  * Will use a straight FUID compare when possible.
714  */
715 boolean_t
716 zfs_groupmember(zfsvfs_t *zfsvfs, uint64_t id, cred_t *cr)
717 {
718 	ksid_t		*ksid = crgetsid(cr, KSID_GROUP);
719 	ksidlist_t	*ksidlist = crgetsidlist(cr);
720 	uid_t		gid;
721 
722 	if (ksid && ksidlist) {
723 		int 		i;
724 		ksid_t		*ksid_groups;
725 		uint32_t	idx = FUID_INDEX(id);
726 		uint32_t	rid = FUID_RID(id);
727 
728 		ksid_groups = ksidlist->ksl_sids;
729 
730 		for (i = 0; i != ksidlist->ksl_nsid; i++) {
731 			if (idx == 0) {
732 				if (id != IDMAP_WK_CREATOR_GROUP_GID &&
733 				    id == ksid_groups[i].ks_id) {
734 					return (B_TRUE);
735 				}
736 			} else {
737 				const char *domain;
738 
739 				domain = zfs_fuid_find_by_idx(zfsvfs, idx);
740 				ASSERT(domain != NULL);
741 
742 				if (strcmp(domain,
743 				    IDMAP_WK_CREATOR_SID_AUTHORITY) == 0)
744 					return (B_FALSE);
745 
746 				if ((strcmp(domain,
747 				    ksid_groups[i].ks_domain->kd_name) == 0) &&
748 				    rid == ksid_groups[i].ks_rid)
749 					return (B_TRUE);
750 			}
751 		}
752 	}
753 
754 	/*
755 	 * Not found in ksidlist, check posix groups
756 	 */
757 	gid = zfs_fuid_map_id(zfsvfs, id, cr, ZFS_GROUP);
758 	return (groupmember(gid, cr));
759 }
760 
761 void
762 zfs_fuid_txhold(zfsvfs_t *zfsvfs, dmu_tx_t *tx)
763 {
764 	if (zfsvfs->z_fuid_obj == 0) {
765 		dmu_tx_hold_bonus(tx, DMU_NEW_OBJECT);
766 		dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0,
767 		    FUID_SIZE_ESTIMATE(zfsvfs));
768 		dmu_tx_hold_zap(tx, MASTER_NODE_OBJ, FALSE, NULL);
769 	} else {
770 		dmu_tx_hold_bonus(tx, zfsvfs->z_fuid_obj);
771 		dmu_tx_hold_write(tx, zfsvfs->z_fuid_obj, 0,
772 		    FUID_SIZE_ESTIMATE(zfsvfs));
773 	}
774 }
775 #endif
776