xref: /titanic_50/usr/src/uts/common/fs/lofs/lofs_vfsops.c (revision 3d729aecc03ea6ebb9bd5d56b8dccd24f57daa41)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
23  */
24 
25 #include <sys/param.h>
26 #include <sys/errno.h>
27 #include <sys/vfs.h>
28 #include <sys/vfs_opreg.h>
29 #include <sys/vnode.h>
30 #include <sys/uio.h>
31 #include <sys/pathname.h>
32 #include <sys/kmem.h>
33 #include <sys/cred.h>
34 #include <sys/statvfs.h>
35 #include <sys/fs/lofs_info.h>
36 #include <sys/fs/lofs_node.h>
37 #include <sys/mount.h>
38 #include <sys/mntent.h>
39 #include <sys/mkdev.h>
40 #include <sys/priv.h>
41 #include <sys/sysmacros.h>
42 #include <sys/systm.h>
43 #include <sys/cmn_err.h>
44 #include <sys/policy.h>
45 #include <sys/tsol/label.h>
46 #include "fs/fs_subr.h"
47 
48 /*
49  * This is the loadable module wrapper.
50  */
51 #include <sys/modctl.h>
52 
53 static mntopts_t lofs_mntopts;
54 
55 static int lofsinit(int, char *);
56 
57 static vfsdef_t vfw = {
58 	VFSDEF_VERSION,
59 	"lofs",
60 	lofsinit,
61 	VSW_HASPROTO|VSW_STATS|VSW_ZMOUNT,
62 	&lofs_mntopts
63 };
64 
65 /*
66  * LOFS mount options table
67  */
68 static char *xattr_cancel[] = { MNTOPT_NOXATTR, NULL };
69 static char *noxattr_cancel[] = { MNTOPT_XATTR, NULL };
70 static char *sub_cancel[] = { MNTOPT_LOFS_NOSUB, NULL };
71 static char *nosub_cancel[] = { MNTOPT_LOFS_SUB, NULL };
72 
73 static mntopt_t mntopts[] = {
74 /*
75  *	option name		cancel option	default arg	flags
76  *		private data
77  */
78 	{ MNTOPT_XATTR,		xattr_cancel,	NULL,		0,
79 		(void *)0 },
80 	{ MNTOPT_NOXATTR,	noxattr_cancel,	NULL,		0,
81 		(void *)0 },
82 	{ MNTOPT_LOFS_SUB,	sub_cancel,	NULL,		0,
83 		(void *)0 },
84 	{ MNTOPT_LOFS_NOSUB,	nosub_cancel,	NULL,		0,
85 		(void *)0 },
86 };
87 
88 static mntopts_t lofs_mntopts = {
89 	sizeof (mntopts) / sizeof (mntopt_t),
90 	mntopts
91 };
92 
93 /*
94  * Module linkage information for the kernel.
95  */
96 
97 static struct modlfs modlfs = {
98 	&mod_fsops, "filesystem for lofs", &vfw
99 };
100 
101 static struct modlinkage modlinkage = {
102 	MODREV_1, (void *)&modlfs, NULL
103 };
104 
105 /*
106  * This is the module initialization routine.
107  */
108 
109 int
110 _init(void)
111 {
112 	int status;
113 
114 	lofs_subrinit();
115 	status = mod_install(&modlinkage);
116 	if (status != 0) {
117 		/*
118 		 * Cleanup previously initialized work.
119 		 */
120 		lofs_subrfini();
121 	}
122 
123 	return (status);
124 }
125 
126 /*
127  * Don't allow the lofs module to be unloaded for now.
128  * There is a memory leak if it gets unloaded.
129  */
130 
131 int
132 _fini(void)
133 {
134 	return (EBUSY);
135 }
136 
137 int
138 _info(struct modinfo *modinfop)
139 {
140 	return (mod_info(&modlinkage, modinfop));
141 }
142 
143 
144 static int lofsfstype;
145 vfsops_t *lo_vfsops;
146 
147 /*
148  * lo mount vfsop
149  * Set up mount info record and attach it to vfs struct.
150  */
151 /*ARGSUSED*/
152 static int
153 lo_mount(struct vfs *vfsp,
154 	struct vnode *vp,
155 	struct mounta *uap,
156 	struct cred *cr)
157 {
158 	int error;
159 	struct vnode *srootvp = NULL;	/* the server's root */
160 	struct vnode *realrootvp;
161 	struct loinfo *li;
162 	int nodev;
163 
164 	nodev = vfs_optionisset(vfsp, MNTOPT_NODEVICES, NULL);
165 
166 	if ((error = secpolicy_fs_mount(cr, vp, vfsp)) != 0)
167 		return (EPERM);
168 
169 	/*
170 	 * Loopback devices which get "nodevices" added can be done without
171 	 * "nodevices" set because we cannot import devices into a zone
172 	 * with loopback.  Note that we have all zone privileges when
173 	 * this happens; if not, we'd have gotten "nosuid".
174 	 */
175 	if (!nodev && vfs_optionisset(vfsp, MNTOPT_NODEVICES, NULL))
176 		vfs_setmntopt(vfsp, MNTOPT_DEVICES, NULL, VFS_NODISPLAY);
177 
178 	mutex_enter(&vp->v_lock);
179 	if (!(uap->flags & MS_OVERLAY) &&
180 	    (vp->v_count != 1 || (vp->v_flag & VROOT))) {
181 		mutex_exit(&vp->v_lock);
182 		return (EBUSY);
183 	}
184 	mutex_exit(&vp->v_lock);
185 
186 	/*
187 	 * Find real root, and make vfs point to real vfs
188 	 */
189 
190 	if (error = lookupname(uap->spec, (uap->flags & MS_SYSSPACE) ?
191 	    UIO_SYSSPACE : UIO_USERSPACE, FOLLOW, NULLVPP, &realrootvp))
192 		return (error);
193 
194 	/*
195 	 * Enforce MAC policy if needed.
196 	 *
197 	 * Loopback mounts must not allow writing up. The dominance test
198 	 * is intended to prevent a global zone caller from accidentally
199 	 * creating write-up conditions between two labeled zones.
200 	 * Local zones can't violate MAC on their own without help from
201 	 * the global zone because they can't name a pathname that
202 	 * they don't already have.
203 	 *
204 	 * The special case check for the NET_MAC_AWARE process flag is
205 	 * to support the case of the automounter in the global zone. We
206 	 * permit automounting of local zone directories such as home
207 	 * directories, into the global zone as required by setlabel,
208 	 * zonecopy, and saving of desktop sessions. Such mounts are
209 	 * trusted not to expose the contents of one zone's directories
210 	 * to another by leaking them through the global zone.
211 	 */
212 	if (is_system_labeled() && crgetzoneid(cr) == GLOBAL_ZONEID) {
213 		char	specname[MAXPATHLEN];
214 		zone_t	*from_zptr;
215 		zone_t	*to_zptr;
216 
217 		if (vnodetopath(NULL, realrootvp, specname,
218 		    sizeof (specname), CRED()) != 0) {
219 			VN_RELE(realrootvp);
220 			return (EACCES);
221 		}
222 
223 		from_zptr = zone_find_by_path(specname);
224 		to_zptr = zone_find_by_path(refstr_value(vfsp->vfs_mntpt));
225 
226 		/*
227 		 * Special case for scratch zones used for Live Upgrade:
228 		 * this is used to mount the zone's root from /root to /a in
229 		 * the scratch zone.  As with the other special case, this
230 		 * appears to be outside of the zone because it's not under
231 		 * the zone rootpath, which is $ZONEPATH/lu in the scratch
232 		 * zone case.
233 		 */
234 
235 		if (from_zptr != to_zptr &&
236 		    !(to_zptr->zone_flags & ZF_IS_SCRATCH)) {
237 			/*
238 			 * We know at this point that the labels aren't equal
239 			 * because the zone pointers aren't equal, and zones
240 			 * can't share a label.
241 			 *
242 			 * If the source is the global zone then making
243 			 * it available to a local zone must be done in
244 			 * read-only mode as the label will become admin_low.
245 			 *
246 			 * If it is a mount between local zones then if
247 			 * the current process is in the global zone and has
248 			 * the NET_MAC_AWARE flag, then regular read-write
249 			 * access is allowed.  If it's in some other zone, but
250 			 * the label on the mount point dominates the original
251 			 * source, then allow the mount as read-only
252 			 * ("read-down").
253 			 */
254 			if (from_zptr->zone_id == GLOBAL_ZONEID) {
255 				/* make the mount read-only */
256 				vfs_setmntopt(vfsp, MNTOPT_RO, NULL, 0);
257 			} else { /* cross-zone mount */
258 				if (to_zptr->zone_id == GLOBAL_ZONEID &&
259 				    /* LINTED: no consequent */
260 				    getpflags(NET_MAC_AWARE, cr) != 0) {
261 					/* Allow the mount as read-write */
262 				} else if (bldominates(
263 				    label2bslabel(to_zptr->zone_slabel),
264 				    label2bslabel(from_zptr->zone_slabel))) {
265 					/* make the mount read-only */
266 					vfs_setmntopt(vfsp, MNTOPT_RO, NULL, 0);
267 				} else {
268 					VN_RELE(realrootvp);
269 					zone_rele(to_zptr);
270 					zone_rele(from_zptr);
271 					return (EACCES);
272 				}
273 			}
274 		}
275 		zone_rele(to_zptr);
276 		zone_rele(from_zptr);
277 	}
278 
279 	/*
280 	 * realrootvp may be an AUTOFS node, in which case we perform a
281 	 * VOP_ACCESS() to trigger the mount of the intended filesystem.
282 	 * This causes a loopback mount of the intended filesystem instead
283 	 * of the AUTOFS filesystem.
284 	 *
285 	 * If a lofs mount creates a mount loop (such that a lofs vfs is
286 	 * mounted on an autofs node and that lofs vfs points back to the
287 	 * autofs node which it is mounted on) then a VOP_ACCESS call will
288 	 * create a deadlock. Once this deadlock is released, VOP_ACCESS will
289 	 * return EINTR. In such a case we don't want the lofs vfs to be
290 	 * created as the loop could panic the system.
291 	 */
292 	if ((error = VOP_ACCESS(realrootvp, 0, 0, cr, NULL)) != 0) {
293 		VN_RELE(realrootvp);
294 		return (error);
295 	}
296 
297 	/*
298 	 * We're interested in the top most filesystem.
299 	 * This is specially important when uap->spec is a trigger
300 	 * AUTOFS node, since we're really interested in mounting the
301 	 * filesystem AUTOFS mounted as result of the VOP_ACCESS()
302 	 * call not the AUTOFS node itself.
303 	 */
304 	if (vn_mountedvfs(realrootvp) != NULL) {
305 		if (error = traverse(&realrootvp)) {
306 			VN_RELE(realrootvp);
307 			return (error);
308 		}
309 	}
310 
311 	/*
312 	 * Allocate a vfs info struct and attach it
313 	 */
314 	li = kmem_zalloc(sizeof (struct loinfo), KM_SLEEP);
315 	li->li_realvfs = realrootvp->v_vfsp;
316 	li->li_mountvfs = vfsp;
317 
318 	/*
319 	 * Set mount flags to be inherited by loopback vfs's
320 	 */
321 	if (vfs_optionisset(vfsp, MNTOPT_RO, NULL)) {
322 		li->li_mflag |= VFS_RDONLY;
323 	}
324 	if (vfs_optionisset(vfsp, MNTOPT_NOSUID, NULL)) {
325 		li->li_mflag |= (VFS_NOSETUID|VFS_NODEVICES);
326 	}
327 	if (vfs_optionisset(vfsp, MNTOPT_NODEVICES, NULL)) {
328 		li->li_mflag |= VFS_NODEVICES;
329 	}
330 	if (vfs_optionisset(vfsp, MNTOPT_NOSETUID, NULL)) {
331 		li->li_mflag |= VFS_NOSETUID;
332 	}
333 	/*
334 	 * Permissive flags are added to the "deny" bitmap.
335 	 */
336 	if (vfs_optionisset(vfsp, MNTOPT_NOXATTR, NULL)) {
337 		li->li_dflag |= VFS_XATTR;
338 	}
339 	if (vfs_optionisset(vfsp, MNTOPT_NONBMAND, NULL)) {
340 		li->li_dflag |= VFS_NBMAND;
341 	}
342 
343 	/*
344 	 * Propagate inheritable mount flags from the real vfs.
345 	 */
346 	if ((li->li_realvfs->vfs_flag & VFS_RDONLY) &&
347 	    !vfs_optionisset(vfsp, MNTOPT_RO, NULL))
348 		vfs_setmntopt(vfsp, MNTOPT_RO, NULL,
349 		    VFS_NODISPLAY);
350 	if ((li->li_realvfs->vfs_flag & VFS_NOSETUID) &&
351 	    !vfs_optionisset(vfsp, MNTOPT_NOSETUID, NULL))
352 		vfs_setmntopt(vfsp, MNTOPT_NOSETUID, NULL,
353 		    VFS_NODISPLAY);
354 	if ((li->li_realvfs->vfs_flag & VFS_NODEVICES) &&
355 	    !vfs_optionisset(vfsp, MNTOPT_NODEVICES, NULL))
356 		vfs_setmntopt(vfsp, MNTOPT_NODEVICES, NULL,
357 		    VFS_NODISPLAY);
358 	/*
359 	 * Permissive flags such as VFS_XATTR, as opposed to restrictive flags
360 	 * such as VFS_RDONLY, are handled differently.  An explicit
361 	 * MNTOPT_NOXATTR should override the underlying filesystem's VFS_XATTR.
362 	 */
363 	if ((li->li_realvfs->vfs_flag & VFS_XATTR) &&
364 	    !vfs_optionisset(vfsp, MNTOPT_NOXATTR, NULL) &&
365 	    !vfs_optionisset(vfsp, MNTOPT_XATTR, NULL))
366 		vfs_setmntopt(vfsp, MNTOPT_XATTR, NULL,
367 		    VFS_NODISPLAY);
368 	if ((li->li_realvfs->vfs_flag & VFS_NBMAND) &&
369 	    !vfs_optionisset(vfsp, MNTOPT_NBMAND, NULL) &&
370 	    !vfs_optionisset(vfsp, MNTOPT_NONBMAND, NULL))
371 		vfs_setmntopt(vfsp, MNTOPT_NBMAND, NULL,
372 		    VFS_NODISPLAY);
373 
374 	li->li_refct = 0;
375 	vfsp->vfs_data = (caddr_t)li;
376 	vfsp->vfs_bcount = 0;
377 	vfsp->vfs_fstype = lofsfstype;
378 	vfsp->vfs_bsize = li->li_realvfs->vfs_bsize;
379 
380 	vfsp->vfs_dev = li->li_realvfs->vfs_dev;
381 	vfsp->vfs_fsid.val[0] = li->li_realvfs->vfs_fsid.val[0];
382 	vfsp->vfs_fsid.val[1] = li->li_realvfs->vfs_fsid.val[1];
383 
384 	if (vfs_optionisset(vfsp, MNTOPT_LOFS_NOSUB, NULL)) {
385 		li->li_flag |= LO_NOSUB;
386 	}
387 
388 	/*
389 	 * Propagate any VFS features
390 	 */
391 
392 	vfs_propagate_features(li->li_realvfs, vfsp);
393 
394 	/*
395 	 * Setup the hashtable. If the root of this mount isn't a directory,
396 	 * there's no point in allocating a large hashtable. A table with one
397 	 * bucket is sufficient.
398 	 */
399 	if (realrootvp->v_type != VDIR)
400 		lsetup(li, 1);
401 	else
402 		lsetup(li, 0);
403 
404 	/*
405 	 * Make the root vnode
406 	 */
407 	srootvp = makelonode(realrootvp, li, 0);
408 	srootvp->v_flag |= VROOT;
409 	li->li_rootvp = srootvp;
410 
411 #ifdef LODEBUG
412 	lo_dprint(4, "lo_mount: vfs %p realvfs %p root %p realroot %p li %p\n",
413 	    vfsp, li->li_realvfs, srootvp, realrootvp, li);
414 #endif
415 	return (0);
416 }
417 
418 /*
419  * Undo loopback mount
420  */
421 static int
422 lo_unmount(struct vfs *vfsp, int flag, struct cred *cr)
423 {
424 	struct loinfo *li;
425 
426 	if (secpolicy_fs_unmount(cr, vfsp) != 0)
427 		return (EPERM);
428 
429 	/*
430 	 * Forced unmount is not supported by this file system
431 	 * and thus, ENOTSUP, is being returned.
432 	 */
433 	if (flag & MS_FORCE)
434 		return (ENOTSUP);
435 
436 	li = vtoli(vfsp);
437 #ifdef LODEBUG
438 	lo_dprint(4, "lo_unmount(%p) li %p\n", vfsp, li);
439 #endif
440 	if (li->li_refct != 1 || li->li_rootvp->v_count != 1) {
441 #ifdef LODEBUG
442 		lo_dprint(4, "refct %d v_ct %d\n", li->li_refct,
443 		    li->li_rootvp->v_count);
444 #endif
445 		return (EBUSY);
446 	}
447 	VN_RELE(li->li_rootvp);
448 	return (0);
449 }
450 
451 /*
452  * Find root of lofs mount.
453  */
454 static int
455 lo_root(struct vfs *vfsp, struct vnode **vpp)
456 {
457 	*vpp = vtoli(vfsp)->li_rootvp;
458 #ifdef LODEBUG
459 	lo_dprint(4, "lo_root(0x%p) = %p\n", vfsp, *vpp);
460 #endif
461 	/*
462 	 * If the root of the filesystem is a special file, return the specvp
463 	 * version of the vnode. We don't save the specvp vnode in our
464 	 * hashtable since that's exclusively for lnodes.
465 	 */
466 	if (IS_DEVVP(*vpp)) {
467 		struct vnode *svp;
468 
469 		svp = specvp(*vpp, (*vpp)->v_rdev, (*vpp)->v_type, kcred);
470 		if (svp == NULL)
471 			return (ENOSYS);
472 		*vpp = svp;
473 	} else {
474 		VN_HOLD(*vpp);
475 	}
476 
477 	return (0);
478 }
479 
480 /*
481  * Get file system statistics.
482  */
483 static int
484 lo_statvfs(register struct vfs *vfsp, struct statvfs64 *sbp)
485 {
486 	vnode_t *realrootvp;
487 
488 #ifdef LODEBUG
489 	lo_dprint(4, "lostatvfs %p\n", vfsp);
490 #endif
491 	/*
492 	 * Using realrootvp->v_vfsp (instead of the realvfsp that was
493 	 * cached) is necessary to make lofs work woth forced UFS unmounts.
494 	 * In the case of a forced unmount, UFS stores a set of dummy vfsops
495 	 * in all the (i)vnodes in the filesystem. The dummy ops simply
496 	 * returns back EIO.
497 	 */
498 	(void) lo_realvfs(vfsp, &realrootvp);
499 	if (realrootvp != NULL)
500 		return (VFS_STATVFS(realrootvp->v_vfsp, sbp));
501 	else
502 		return (EIO);
503 }
504 
505 /*
506  * LOFS doesn't have any data or metadata to flush, pending I/O on the
507  * underlying filesystem will be flushed when such filesystem is synched.
508  */
509 /* ARGSUSED */
510 static int
511 lo_sync(struct vfs *vfsp,
512 	short flag,
513 	struct cred *cr)
514 {
515 #ifdef LODEBUG
516 	lo_dprint(4, "lo_sync: %p\n", vfsp);
517 #endif
518 	return (0);
519 }
520 
521 /*
522  * Obtain the vnode from the underlying filesystem.
523  */
524 static int
525 lo_vget(struct vfs *vfsp, struct vnode **vpp, struct fid *fidp)
526 {
527 	vnode_t *realrootvp;
528 
529 #ifdef LODEBUG
530 	lo_dprint(4, "lo_vget: %p\n", vfsp);
531 #endif
532 	(void) lo_realvfs(vfsp, &realrootvp);
533 	if (realrootvp != NULL)
534 		return (VFS_VGET(realrootvp->v_vfsp, vpp, fidp));
535 	else
536 		return (EIO);
537 }
538 
539 /*
540  * Free mount-specific data.
541  */
542 static void
543 lo_freevfs(struct vfs *vfsp)
544 {
545 	struct loinfo *li = vtoli(vfsp);
546 
547 	ldestroy(li);
548 	kmem_free(li, sizeof (struct loinfo));
549 }
550 
551 static int
552 lofsinit(int fstyp, char *name)
553 {
554 	static const fs_operation_def_t lo_vfsops_template[] = {
555 		VFSNAME_MOUNT,		{ .vfs_mount = lo_mount },
556 		VFSNAME_UNMOUNT,	{ .vfs_unmount = lo_unmount },
557 		VFSNAME_ROOT,		{ .vfs_root = lo_root },
558 		VFSNAME_STATVFS,	{ .vfs_statvfs = lo_statvfs },
559 		VFSNAME_SYNC,		{ .vfs_sync = lo_sync },
560 		VFSNAME_VGET,		{ .vfs_vget = lo_vget },
561 		VFSNAME_FREEVFS,	{ .vfs_freevfs = lo_freevfs },
562 		NULL,			NULL
563 	};
564 	int error;
565 
566 	error = vfs_setfsops(fstyp, lo_vfsops_template, &lo_vfsops);
567 	if (error != 0) {
568 		cmn_err(CE_WARN, "lofsinit: bad vfs ops template");
569 		return (error);
570 	}
571 
572 	error = vn_make_ops(name, lo_vnodeops_template, &lo_vnodeops);
573 	if (error != 0) {
574 		(void) vfs_freevfsops_by_type(fstyp);
575 		cmn_err(CE_WARN, "lofsinit: bad vnode ops template");
576 		return (error);
577 	}
578 
579 	lofsfstype = fstyp;
580 
581 	return (0);
582 }
583