1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #include <sys/types.h> 27 #include <sys/param.h> 28 #include <sys/time.h> 29 #include <sys/systm.h> 30 #include <sys/sysmacros.h> 31 #include <sys/resource.h> 32 #include <sys/vfs.h> 33 #include <sys/vnode.h> 34 #include <sys/sid.h> 35 #include <sys/file.h> 36 #include <sys/stat.h> 37 #include <sys/kmem.h> 38 #include <sys/cmn_err.h> 39 #include <sys/errno.h> 40 #include <sys/unistd.h> 41 #include <sys/sdt.h> 42 #include <sys/fs/zfs.h> 43 #include <sys/mode.h> 44 #include <sys/policy.h> 45 #include <sys/zfs_znode.h> 46 #include <sys/zfs_fuid.h> 47 #include <sys/zfs_acl.h> 48 #include <sys/zfs_dir.h> 49 #include <sys/zfs_vfsops.h> 50 #include <sys/dmu.h> 51 #include <sys/dnode.h> 52 #include <sys/zap.h> 53 #include <sys/sa.h> 54 #include "fs/fs_subr.h" 55 #include <acl/acl_common.h> 56 57 #define ALLOW ACE_ACCESS_ALLOWED_ACE_TYPE 58 #define DENY ACE_ACCESS_DENIED_ACE_TYPE 59 #define MAX_ACE_TYPE ACE_SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE 60 #define MIN_ACE_TYPE ALLOW 61 62 #define OWNING_GROUP (ACE_GROUP|ACE_IDENTIFIER_GROUP) 63 #define EVERYONE_ALLOW_MASK (ACE_READ_ACL|ACE_READ_ATTRIBUTES | \ 64 ACE_READ_NAMED_ATTRS|ACE_SYNCHRONIZE) 65 #define EVERYONE_DENY_MASK (ACE_WRITE_ACL|ACE_WRITE_OWNER | \ 66 ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS) 67 #define OWNER_ALLOW_MASK (ACE_WRITE_ACL | ACE_WRITE_OWNER | \ 68 ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS) 69 70 #define ZFS_CHECKED_MASKS (ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_READ_DATA| \ 71 ACE_READ_NAMED_ATTRS|ACE_WRITE_DATA|ACE_WRITE_ATTRIBUTES| \ 72 ACE_WRITE_NAMED_ATTRS|ACE_APPEND_DATA|ACE_EXECUTE|ACE_WRITE_OWNER| \ 73 ACE_WRITE_ACL|ACE_DELETE|ACE_DELETE_CHILD|ACE_SYNCHRONIZE) 74 75 #define WRITE_MASK_DATA (ACE_WRITE_DATA|ACE_APPEND_DATA|ACE_WRITE_NAMED_ATTRS) 76 #define WRITE_MASK_ATTRS (ACE_WRITE_ACL|ACE_WRITE_OWNER|ACE_WRITE_ATTRIBUTES| \ 77 ACE_DELETE|ACE_DELETE_CHILD) 78 #define WRITE_MASK (WRITE_MASK_DATA|WRITE_MASK_ATTRS) 79 80 #define OGE_CLEAR (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \ 81 ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE) 82 83 #define OKAY_MASK_BITS (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \ 84 ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE) 85 86 #define ALL_INHERIT (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE | \ 87 ACE_NO_PROPAGATE_INHERIT_ACE|ACE_INHERIT_ONLY_ACE|ACE_INHERITED_ACE) 88 89 #define RESTRICTED_CLEAR (ACE_WRITE_ACL|ACE_WRITE_OWNER) 90 91 #define V4_ACL_WIDE_FLAGS (ZFS_ACL_AUTO_INHERIT|ZFS_ACL_DEFAULTED|\ 92 ZFS_ACL_PROTECTED) 93 94 #define ZFS_ACL_WIDE_FLAGS (V4_ACL_WIDE_FLAGS|ZFS_ACL_TRIVIAL|ZFS_INHERIT_ACE|\ 95 ZFS_ACL_OBJ_ACE) 96 97 #define ALL_MODE_EXECS (S_IXUSR | S_IXGRP | S_IXOTH) 98 99 static uint16_t 100 zfs_ace_v0_get_type(void *acep) 101 { 102 return (((zfs_oldace_t *)acep)->z_type); 103 } 104 105 static uint16_t 106 zfs_ace_v0_get_flags(void *acep) 107 { 108 return (((zfs_oldace_t *)acep)->z_flags); 109 } 110 111 static uint32_t 112 zfs_ace_v0_get_mask(void *acep) 113 { 114 return (((zfs_oldace_t *)acep)->z_access_mask); 115 } 116 117 static uint64_t 118 zfs_ace_v0_get_who(void *acep) 119 { 120 return (((zfs_oldace_t *)acep)->z_fuid); 121 } 122 123 static void 124 zfs_ace_v0_set_type(void *acep, uint16_t type) 125 { 126 ((zfs_oldace_t *)acep)->z_type = type; 127 } 128 129 static void 130 zfs_ace_v0_set_flags(void *acep, uint16_t flags) 131 { 132 ((zfs_oldace_t *)acep)->z_flags = flags; 133 } 134 135 static void 136 zfs_ace_v0_set_mask(void *acep, uint32_t mask) 137 { 138 ((zfs_oldace_t *)acep)->z_access_mask = mask; 139 } 140 141 static void 142 zfs_ace_v0_set_who(void *acep, uint64_t who) 143 { 144 ((zfs_oldace_t *)acep)->z_fuid = who; 145 } 146 147 /*ARGSUSED*/ 148 static size_t 149 zfs_ace_v0_size(void *acep) 150 { 151 return (sizeof (zfs_oldace_t)); 152 } 153 154 static size_t 155 zfs_ace_v0_abstract_size(void) 156 { 157 return (sizeof (zfs_oldace_t)); 158 } 159 160 static int 161 zfs_ace_v0_mask_off(void) 162 { 163 return (offsetof(zfs_oldace_t, z_access_mask)); 164 } 165 166 /*ARGSUSED*/ 167 static int 168 zfs_ace_v0_data(void *acep, void **datap) 169 { 170 *datap = NULL; 171 return (0); 172 } 173 174 static acl_ops_t zfs_acl_v0_ops = { 175 zfs_ace_v0_get_mask, 176 zfs_ace_v0_set_mask, 177 zfs_ace_v0_get_flags, 178 zfs_ace_v0_set_flags, 179 zfs_ace_v0_get_type, 180 zfs_ace_v0_set_type, 181 zfs_ace_v0_get_who, 182 zfs_ace_v0_set_who, 183 zfs_ace_v0_size, 184 zfs_ace_v0_abstract_size, 185 zfs_ace_v0_mask_off, 186 zfs_ace_v0_data 187 }; 188 189 static uint16_t 190 zfs_ace_fuid_get_type(void *acep) 191 { 192 return (((zfs_ace_hdr_t *)acep)->z_type); 193 } 194 195 static uint16_t 196 zfs_ace_fuid_get_flags(void *acep) 197 { 198 return (((zfs_ace_hdr_t *)acep)->z_flags); 199 } 200 201 static uint32_t 202 zfs_ace_fuid_get_mask(void *acep) 203 { 204 return (((zfs_ace_hdr_t *)acep)->z_access_mask); 205 } 206 207 static uint64_t 208 zfs_ace_fuid_get_who(void *args) 209 { 210 uint16_t entry_type; 211 zfs_ace_t *acep = args; 212 213 entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS; 214 215 if (entry_type == ACE_OWNER || entry_type == OWNING_GROUP || 216 entry_type == ACE_EVERYONE) 217 return (-1); 218 return (((zfs_ace_t *)acep)->z_fuid); 219 } 220 221 static void 222 zfs_ace_fuid_set_type(void *acep, uint16_t type) 223 { 224 ((zfs_ace_hdr_t *)acep)->z_type = type; 225 } 226 227 static void 228 zfs_ace_fuid_set_flags(void *acep, uint16_t flags) 229 { 230 ((zfs_ace_hdr_t *)acep)->z_flags = flags; 231 } 232 233 static void 234 zfs_ace_fuid_set_mask(void *acep, uint32_t mask) 235 { 236 ((zfs_ace_hdr_t *)acep)->z_access_mask = mask; 237 } 238 239 static void 240 zfs_ace_fuid_set_who(void *arg, uint64_t who) 241 { 242 zfs_ace_t *acep = arg; 243 244 uint16_t entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS; 245 246 if (entry_type == ACE_OWNER || entry_type == OWNING_GROUP || 247 entry_type == ACE_EVERYONE) 248 return; 249 acep->z_fuid = who; 250 } 251 252 static size_t 253 zfs_ace_fuid_size(void *acep) 254 { 255 zfs_ace_hdr_t *zacep = acep; 256 uint16_t entry_type; 257 258 switch (zacep->z_type) { 259 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 260 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 261 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 262 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 263 return (sizeof (zfs_object_ace_t)); 264 case ALLOW: 265 case DENY: 266 entry_type = 267 (((zfs_ace_hdr_t *)acep)->z_flags & ACE_TYPE_FLAGS); 268 if (entry_type == ACE_OWNER || 269 entry_type == OWNING_GROUP || 270 entry_type == ACE_EVERYONE) 271 return (sizeof (zfs_ace_hdr_t)); 272 /*FALLTHROUGH*/ 273 default: 274 return (sizeof (zfs_ace_t)); 275 } 276 } 277 278 static size_t 279 zfs_ace_fuid_abstract_size(void) 280 { 281 return (sizeof (zfs_ace_hdr_t)); 282 } 283 284 static int 285 zfs_ace_fuid_mask_off(void) 286 { 287 return (offsetof(zfs_ace_hdr_t, z_access_mask)); 288 } 289 290 static int 291 zfs_ace_fuid_data(void *acep, void **datap) 292 { 293 zfs_ace_t *zacep = acep; 294 zfs_object_ace_t *zobjp; 295 296 switch (zacep->z_hdr.z_type) { 297 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 298 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 299 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 300 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 301 zobjp = acep; 302 *datap = (caddr_t)zobjp + sizeof (zfs_ace_t); 303 return (sizeof (zfs_object_ace_t) - sizeof (zfs_ace_t)); 304 default: 305 *datap = NULL; 306 return (0); 307 } 308 } 309 310 static acl_ops_t zfs_acl_fuid_ops = { 311 zfs_ace_fuid_get_mask, 312 zfs_ace_fuid_set_mask, 313 zfs_ace_fuid_get_flags, 314 zfs_ace_fuid_set_flags, 315 zfs_ace_fuid_get_type, 316 zfs_ace_fuid_set_type, 317 zfs_ace_fuid_get_who, 318 zfs_ace_fuid_set_who, 319 zfs_ace_fuid_size, 320 zfs_ace_fuid_abstract_size, 321 zfs_ace_fuid_mask_off, 322 zfs_ace_fuid_data 323 }; 324 325 /* 326 * The following three functions are provided for compatibility with 327 * older ZPL version in order to determine if the file use to have 328 * an external ACL and what version of ACL previously existed on the 329 * file. Would really be nice to not need this, sigh. 330 */ 331 332 uint64_t 333 zfs_external_acl(znode_t *zp) 334 { 335 zfs_acl_phys_t acl_phys; 336 337 if (zp->z_is_sa) 338 return (0); 339 340 VERIFY(0 == sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zp->z_zfsvfs), 341 &acl_phys, sizeof (acl_phys))); 342 343 return (acl_phys.z_acl_extern_obj); 344 } 345 346 /* 347 * Determine size of ACL in bytes 348 * 349 * This is more complicated than it should be since we have to deal 350 * with old external ACLs. 351 */ 352 static int 353 zfs_acl_znode_info(znode_t *zp, int *aclsize, int *aclcount, 354 zfs_acl_phys_t *aclphys) 355 { 356 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 357 uint64_t acl_count; 358 int size; 359 int error; 360 361 if (zp->z_is_sa) { 362 if ((error = sa_size(zp->z_sa_hdl, SA_ZPL_DACL_ACES(zfsvfs), 363 &size)) != 0) 364 return (error); 365 *aclsize = size; 366 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_DACL_COUNT(zfsvfs), 367 &acl_count, sizeof (acl_count))) != 0) 368 return (error); 369 *aclcount = acl_count; 370 } else { 371 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zfsvfs), 372 aclphys, sizeof (*aclphys))) != 0) 373 return (error); 374 375 if (aclphys->z_acl_version == ZFS_ACL_VERSION_INITIAL) { 376 *aclsize = ZFS_ACL_SIZE(aclphys->z_acl_size); 377 *aclcount = aclphys->z_acl_size; 378 } else { 379 *aclsize = aclphys->z_acl_size; 380 *aclcount = aclphys->z_acl_count; 381 } 382 } 383 return (0); 384 } 385 386 int 387 zfs_znode_acl_version(znode_t *zp) 388 { 389 zfs_acl_phys_t acl_phys; 390 391 if (zp->z_is_sa) { 392 return (ZFS_ACL_VERSION_FUID); 393 } else { 394 VERIFY(0 == sa_lookup(zp->z_sa_hdl, 395 SA_ZPL_ZNODE_ACL(zp->z_zfsvfs), 396 &acl_phys, sizeof (acl_phys))); 397 return (acl_phys.z_acl_version); 398 } 399 } 400 401 static int 402 zfs_acl_version(int version) 403 { 404 if (version < ZPL_VERSION_FUID) 405 return (ZFS_ACL_VERSION_INITIAL); 406 else 407 return (ZFS_ACL_VERSION_FUID); 408 } 409 410 static int 411 zfs_acl_version_zp(znode_t *zp) 412 { 413 return (zfs_acl_version(zp->z_zfsvfs->z_version)); 414 } 415 416 zfs_acl_t * 417 zfs_acl_alloc(int vers) 418 { 419 zfs_acl_t *aclp; 420 421 aclp = kmem_zalloc(sizeof (zfs_acl_t), KM_SLEEP); 422 list_create(&aclp->z_acl, sizeof (zfs_acl_node_t), 423 offsetof(zfs_acl_node_t, z_next)); 424 aclp->z_version = vers; 425 if (vers == ZFS_ACL_VERSION_FUID) 426 aclp->z_ops = zfs_acl_fuid_ops; 427 else 428 aclp->z_ops = zfs_acl_v0_ops; 429 return (aclp); 430 } 431 432 zfs_acl_node_t * 433 zfs_acl_node_alloc(size_t bytes) 434 { 435 zfs_acl_node_t *aclnode; 436 437 aclnode = kmem_zalloc(sizeof (zfs_acl_node_t), KM_SLEEP); 438 if (bytes) { 439 aclnode->z_acldata = kmem_alloc(bytes, KM_SLEEP); 440 aclnode->z_allocdata = aclnode->z_acldata; 441 aclnode->z_allocsize = bytes; 442 aclnode->z_size = bytes; 443 } 444 445 return (aclnode); 446 } 447 448 static void 449 zfs_acl_node_free(zfs_acl_node_t *aclnode) 450 { 451 if (aclnode->z_allocsize) 452 kmem_free(aclnode->z_allocdata, aclnode->z_allocsize); 453 kmem_free(aclnode, sizeof (zfs_acl_node_t)); 454 } 455 456 static void 457 zfs_acl_release_nodes(zfs_acl_t *aclp) 458 { 459 zfs_acl_node_t *aclnode; 460 461 while (aclnode = list_head(&aclp->z_acl)) { 462 list_remove(&aclp->z_acl, aclnode); 463 zfs_acl_node_free(aclnode); 464 } 465 aclp->z_acl_count = 0; 466 aclp->z_acl_bytes = 0; 467 } 468 469 void 470 zfs_acl_free(zfs_acl_t *aclp) 471 { 472 zfs_acl_release_nodes(aclp); 473 list_destroy(&aclp->z_acl); 474 kmem_free(aclp, sizeof (zfs_acl_t)); 475 } 476 477 static boolean_t 478 zfs_acl_valid_ace_type(uint_t type, uint_t flags) 479 { 480 uint16_t entry_type; 481 482 switch (type) { 483 case ALLOW: 484 case DENY: 485 case ACE_SYSTEM_AUDIT_ACE_TYPE: 486 case ACE_SYSTEM_ALARM_ACE_TYPE: 487 entry_type = flags & ACE_TYPE_FLAGS; 488 return (entry_type == ACE_OWNER || 489 entry_type == OWNING_GROUP || 490 entry_type == ACE_EVERYONE || entry_type == 0 || 491 entry_type == ACE_IDENTIFIER_GROUP); 492 default: 493 if (type >= MIN_ACE_TYPE && type <= MAX_ACE_TYPE) 494 return (B_TRUE); 495 } 496 return (B_FALSE); 497 } 498 499 static boolean_t 500 zfs_ace_valid(vtype_t obj_type, zfs_acl_t *aclp, uint16_t type, uint16_t iflags) 501 { 502 /* 503 * first check type of entry 504 */ 505 506 if (!zfs_acl_valid_ace_type(type, iflags)) 507 return (B_FALSE); 508 509 switch (type) { 510 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 511 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 512 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 513 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 514 if (aclp->z_version < ZFS_ACL_VERSION_FUID) 515 return (B_FALSE); 516 aclp->z_hints |= ZFS_ACL_OBJ_ACE; 517 } 518 519 /* 520 * next check inheritance level flags 521 */ 522 523 if (obj_type == VDIR && 524 (iflags & (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE))) 525 aclp->z_hints |= ZFS_INHERIT_ACE; 526 527 if (iflags & (ACE_INHERIT_ONLY_ACE|ACE_NO_PROPAGATE_INHERIT_ACE)) { 528 if ((iflags & (ACE_FILE_INHERIT_ACE| 529 ACE_DIRECTORY_INHERIT_ACE)) == 0) { 530 return (B_FALSE); 531 } 532 } 533 534 return (B_TRUE); 535 } 536 537 static void * 538 zfs_acl_next_ace(zfs_acl_t *aclp, void *start, uint64_t *who, 539 uint32_t *access_mask, uint16_t *iflags, uint16_t *type) 540 { 541 zfs_acl_node_t *aclnode; 542 543 ASSERT(aclp); 544 545 if (start == NULL) { 546 aclnode = list_head(&aclp->z_acl); 547 if (aclnode == NULL) 548 return (NULL); 549 550 aclp->z_next_ace = aclnode->z_acldata; 551 aclp->z_curr_node = aclnode; 552 aclnode->z_ace_idx = 0; 553 } 554 555 aclnode = aclp->z_curr_node; 556 557 if (aclnode == NULL) 558 return (NULL); 559 560 if (aclnode->z_ace_idx >= aclnode->z_ace_count) { 561 aclnode = list_next(&aclp->z_acl, aclnode); 562 if (aclnode == NULL) 563 return (NULL); 564 else { 565 aclp->z_curr_node = aclnode; 566 aclnode->z_ace_idx = 0; 567 aclp->z_next_ace = aclnode->z_acldata; 568 } 569 } 570 571 if (aclnode->z_ace_idx < aclnode->z_ace_count) { 572 void *acep = aclp->z_next_ace; 573 size_t ace_size; 574 575 /* 576 * Make sure we don't overstep our bounds 577 */ 578 ace_size = aclp->z_ops.ace_size(acep); 579 580 if (((caddr_t)acep + ace_size) > 581 ((caddr_t)aclnode->z_acldata + aclnode->z_size)) { 582 return (NULL); 583 } 584 585 *iflags = aclp->z_ops.ace_flags_get(acep); 586 *type = aclp->z_ops.ace_type_get(acep); 587 *access_mask = aclp->z_ops.ace_mask_get(acep); 588 *who = aclp->z_ops.ace_who_get(acep); 589 aclp->z_next_ace = (caddr_t)aclp->z_next_ace + ace_size; 590 aclnode->z_ace_idx++; 591 592 return ((void *)acep); 593 } 594 return (NULL); 595 } 596 597 /*ARGSUSED*/ 598 static uint64_t 599 zfs_ace_walk(void *datap, uint64_t cookie, int aclcnt, 600 uint16_t *flags, uint16_t *type, uint32_t *mask) 601 { 602 zfs_acl_t *aclp = datap; 603 zfs_ace_hdr_t *acep = (zfs_ace_hdr_t *)(uintptr_t)cookie; 604 uint64_t who; 605 606 acep = zfs_acl_next_ace(aclp, acep, &who, mask, 607 flags, type); 608 return ((uint64_t)(uintptr_t)acep); 609 } 610 611 static zfs_acl_node_t * 612 zfs_acl_curr_node(zfs_acl_t *aclp) 613 { 614 ASSERT(aclp->z_curr_node); 615 return (aclp->z_curr_node); 616 } 617 618 /* 619 * Copy ACE to internal ZFS format. 620 * While processing the ACL each ACE will be validated for correctness. 621 * ACE FUIDs will be created later. 622 */ 623 int 624 zfs_copy_ace_2_fuid(zfsvfs_t *zfsvfs, vtype_t obj_type, zfs_acl_t *aclp, 625 void *datap, zfs_ace_t *z_acl, uint64_t aclcnt, size_t *size, 626 zfs_fuid_info_t **fuidp, cred_t *cr) 627 { 628 int i; 629 uint16_t entry_type; 630 zfs_ace_t *aceptr = z_acl; 631 ace_t *acep = datap; 632 zfs_object_ace_t *zobjacep; 633 ace_object_t *aceobjp; 634 635 for (i = 0; i != aclcnt; i++) { 636 aceptr->z_hdr.z_access_mask = acep->a_access_mask; 637 aceptr->z_hdr.z_flags = acep->a_flags; 638 aceptr->z_hdr.z_type = acep->a_type; 639 entry_type = aceptr->z_hdr.z_flags & ACE_TYPE_FLAGS; 640 if (entry_type != ACE_OWNER && entry_type != OWNING_GROUP && 641 entry_type != ACE_EVERYONE) { 642 aceptr->z_fuid = zfs_fuid_create(zfsvfs, acep->a_who, 643 cr, (entry_type == 0) ? 644 ZFS_ACE_USER : ZFS_ACE_GROUP, fuidp); 645 } 646 647 /* 648 * Make sure ACE is valid 649 */ 650 if (zfs_ace_valid(obj_type, aclp, aceptr->z_hdr.z_type, 651 aceptr->z_hdr.z_flags) != B_TRUE) 652 return (EINVAL); 653 654 switch (acep->a_type) { 655 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 656 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 657 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 658 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 659 zobjacep = (zfs_object_ace_t *)aceptr; 660 aceobjp = (ace_object_t *)acep; 661 662 bcopy(aceobjp->a_obj_type, zobjacep->z_object_type, 663 sizeof (aceobjp->a_obj_type)); 664 bcopy(aceobjp->a_inherit_obj_type, 665 zobjacep->z_inherit_type, 666 sizeof (aceobjp->a_inherit_obj_type)); 667 acep = (ace_t *)((caddr_t)acep + sizeof (ace_object_t)); 668 break; 669 default: 670 acep = (ace_t *)((caddr_t)acep + sizeof (ace_t)); 671 } 672 673 aceptr = (zfs_ace_t *)((caddr_t)aceptr + 674 aclp->z_ops.ace_size(aceptr)); 675 } 676 677 *size = (caddr_t)aceptr - (caddr_t)z_acl; 678 679 return (0); 680 } 681 682 /* 683 * Copy ZFS ACEs to fixed size ace_t layout 684 */ 685 static void 686 zfs_copy_fuid_2_ace(zfsvfs_t *zfsvfs, zfs_acl_t *aclp, cred_t *cr, 687 void *datap, int filter) 688 { 689 uint64_t who; 690 uint32_t access_mask; 691 uint16_t iflags, type; 692 zfs_ace_hdr_t *zacep = NULL; 693 ace_t *acep = datap; 694 ace_object_t *objacep; 695 zfs_object_ace_t *zobjacep; 696 size_t ace_size; 697 uint16_t entry_type; 698 699 while (zacep = zfs_acl_next_ace(aclp, zacep, 700 &who, &access_mask, &iflags, &type)) { 701 702 switch (type) { 703 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 704 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 705 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 706 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 707 if (filter) { 708 continue; 709 } 710 zobjacep = (zfs_object_ace_t *)zacep; 711 objacep = (ace_object_t *)acep; 712 bcopy(zobjacep->z_object_type, 713 objacep->a_obj_type, 714 sizeof (zobjacep->z_object_type)); 715 bcopy(zobjacep->z_inherit_type, 716 objacep->a_inherit_obj_type, 717 sizeof (zobjacep->z_inherit_type)); 718 ace_size = sizeof (ace_object_t); 719 break; 720 default: 721 ace_size = sizeof (ace_t); 722 break; 723 } 724 725 entry_type = (iflags & ACE_TYPE_FLAGS); 726 if ((entry_type != ACE_OWNER && 727 entry_type != OWNING_GROUP && 728 entry_type != ACE_EVERYONE)) { 729 acep->a_who = zfs_fuid_map_id(zfsvfs, who, 730 cr, (entry_type & ACE_IDENTIFIER_GROUP) ? 731 ZFS_ACE_GROUP : ZFS_ACE_USER); 732 } else { 733 acep->a_who = (uid_t)(int64_t)who; 734 } 735 acep->a_access_mask = access_mask; 736 acep->a_flags = iflags; 737 acep->a_type = type; 738 acep = (ace_t *)((caddr_t)acep + ace_size); 739 } 740 } 741 742 static int 743 zfs_copy_ace_2_oldace(vtype_t obj_type, zfs_acl_t *aclp, ace_t *acep, 744 zfs_oldace_t *z_acl, int aclcnt, size_t *size) 745 { 746 int i; 747 zfs_oldace_t *aceptr = z_acl; 748 749 for (i = 0; i != aclcnt; i++, aceptr++) { 750 aceptr->z_access_mask = acep[i].a_access_mask; 751 aceptr->z_type = acep[i].a_type; 752 aceptr->z_flags = acep[i].a_flags; 753 aceptr->z_fuid = acep[i].a_who; 754 /* 755 * Make sure ACE is valid 756 */ 757 if (zfs_ace_valid(obj_type, aclp, aceptr->z_type, 758 aceptr->z_flags) != B_TRUE) 759 return (EINVAL); 760 } 761 *size = (caddr_t)aceptr - (caddr_t)z_acl; 762 return (0); 763 } 764 765 /* 766 * convert old ACL format to new 767 */ 768 void 769 zfs_acl_xform(znode_t *zp, zfs_acl_t *aclp, cred_t *cr) 770 { 771 zfs_oldace_t *oldaclp; 772 int i; 773 uint16_t type, iflags; 774 uint32_t access_mask; 775 uint64_t who; 776 void *cookie = NULL; 777 zfs_acl_node_t *newaclnode; 778 779 ASSERT(aclp->z_version == ZFS_ACL_VERSION_INITIAL); 780 /* 781 * First create the ACE in a contiguous piece of memory 782 * for zfs_copy_ace_2_fuid(). 783 * 784 * We only convert an ACL once, so this won't happen 785 * everytime. 786 */ 787 oldaclp = kmem_alloc(sizeof (zfs_oldace_t) * aclp->z_acl_count, 788 KM_SLEEP); 789 i = 0; 790 while (cookie = zfs_acl_next_ace(aclp, cookie, &who, 791 &access_mask, &iflags, &type)) { 792 oldaclp[i].z_flags = iflags; 793 oldaclp[i].z_type = type; 794 oldaclp[i].z_fuid = who; 795 oldaclp[i++].z_access_mask = access_mask; 796 } 797 798 newaclnode = zfs_acl_node_alloc(aclp->z_acl_count * 799 sizeof (zfs_object_ace_t)); 800 aclp->z_ops = zfs_acl_fuid_ops; 801 VERIFY(zfs_copy_ace_2_fuid(zp->z_zfsvfs, ZTOV(zp)->v_type, aclp, 802 oldaclp, newaclnode->z_acldata, aclp->z_acl_count, 803 &newaclnode->z_size, NULL, cr) == 0); 804 newaclnode->z_ace_count = aclp->z_acl_count; 805 aclp->z_version = ZFS_ACL_VERSION; 806 kmem_free(oldaclp, aclp->z_acl_count * sizeof (zfs_oldace_t)); 807 808 /* 809 * Release all previous ACL nodes 810 */ 811 812 zfs_acl_release_nodes(aclp); 813 814 list_insert_head(&aclp->z_acl, newaclnode); 815 816 aclp->z_acl_bytes = newaclnode->z_size; 817 aclp->z_acl_count = newaclnode->z_ace_count; 818 819 } 820 821 /* 822 * Convert unix access mask to v4 access mask 823 */ 824 static uint32_t 825 zfs_unix_to_v4(uint32_t access_mask) 826 { 827 uint32_t new_mask = 0; 828 829 if (access_mask & S_IXOTH) 830 new_mask |= ACE_EXECUTE; 831 if (access_mask & S_IWOTH) 832 new_mask |= ACE_WRITE_DATA; 833 if (access_mask & S_IROTH) 834 new_mask |= ACE_READ_DATA; 835 return (new_mask); 836 } 837 838 static void 839 zfs_set_ace(zfs_acl_t *aclp, void *acep, uint32_t access_mask, 840 uint16_t access_type, uint64_t fuid, uint16_t entry_type) 841 { 842 uint16_t type = entry_type & ACE_TYPE_FLAGS; 843 844 aclp->z_ops.ace_mask_set(acep, access_mask); 845 aclp->z_ops.ace_type_set(acep, access_type); 846 aclp->z_ops.ace_flags_set(acep, entry_type); 847 if ((type != ACE_OWNER && type != OWNING_GROUP && 848 type != ACE_EVERYONE)) 849 aclp->z_ops.ace_who_set(acep, fuid); 850 } 851 852 /* 853 * Determine mode of file based on ACL. 854 * Also, create FUIDs for any User/Group ACEs 855 */ 856 uint64_t 857 zfs_mode_compute(uint64_t fmode, zfs_acl_t *aclp, uint64_t *pflags) 858 { 859 int entry_type; 860 mode_t mode; 861 mode_t seen = 0; 862 zfs_ace_hdr_t *acep = NULL; 863 uint64_t who; 864 uint16_t iflags, type; 865 uint32_t access_mask; 866 boolean_t an_exec_denied = B_FALSE; 867 868 mode = (fmode & (S_IFMT | S_ISUID | S_ISGID | S_ISVTX)); 869 870 while (acep = zfs_acl_next_ace(aclp, acep, &who, 871 &access_mask, &iflags, &type)) { 872 873 if (!zfs_acl_valid_ace_type(type, iflags)) 874 continue; 875 876 entry_type = (iflags & ACE_TYPE_FLAGS); 877 878 /* 879 * Skip over owner@, group@ or everyone@ inherit only ACEs 880 */ 881 if ((iflags & ACE_INHERIT_ONLY_ACE) && 882 (entry_type == ACE_OWNER || entry_type == ACE_EVERYONE || 883 entry_type == OWNING_GROUP)) 884 continue; 885 886 if (entry_type == ACE_OWNER) { 887 if ((access_mask & ACE_READ_DATA) && 888 (!(seen & S_IRUSR))) { 889 seen |= S_IRUSR; 890 if (type == ALLOW) { 891 mode |= S_IRUSR; 892 } 893 } 894 if ((access_mask & ACE_WRITE_DATA) && 895 (!(seen & S_IWUSR))) { 896 seen |= S_IWUSR; 897 if (type == ALLOW) { 898 mode |= S_IWUSR; 899 } 900 } 901 if ((access_mask & ACE_EXECUTE) && 902 (!(seen & S_IXUSR))) { 903 seen |= S_IXUSR; 904 if (type == ALLOW) { 905 mode |= S_IXUSR; 906 } 907 } 908 } else if (entry_type == OWNING_GROUP) { 909 if ((access_mask & ACE_READ_DATA) && 910 (!(seen & S_IRGRP))) { 911 seen |= S_IRGRP; 912 if (type == ALLOW) { 913 mode |= S_IRGRP; 914 } 915 } 916 if ((access_mask & ACE_WRITE_DATA) && 917 (!(seen & S_IWGRP))) { 918 seen |= S_IWGRP; 919 if (type == ALLOW) { 920 mode |= S_IWGRP; 921 } 922 } 923 if ((access_mask & ACE_EXECUTE) && 924 (!(seen & S_IXGRP))) { 925 seen |= S_IXGRP; 926 if (type == ALLOW) { 927 mode |= S_IXGRP; 928 } 929 } 930 } else if (entry_type == ACE_EVERYONE) { 931 if ((access_mask & ACE_READ_DATA)) { 932 if (!(seen & S_IRUSR)) { 933 seen |= S_IRUSR; 934 if (type == ALLOW) { 935 mode |= S_IRUSR; 936 } 937 } 938 if (!(seen & S_IRGRP)) { 939 seen |= S_IRGRP; 940 if (type == ALLOW) { 941 mode |= S_IRGRP; 942 } 943 } 944 if (!(seen & S_IROTH)) { 945 seen |= S_IROTH; 946 if (type == ALLOW) { 947 mode |= S_IROTH; 948 } 949 } 950 } 951 if ((access_mask & ACE_WRITE_DATA)) { 952 if (!(seen & S_IWUSR)) { 953 seen |= S_IWUSR; 954 if (type == ALLOW) { 955 mode |= S_IWUSR; 956 } 957 } 958 if (!(seen & S_IWGRP)) { 959 seen |= S_IWGRP; 960 if (type == ALLOW) { 961 mode |= S_IWGRP; 962 } 963 } 964 if (!(seen & S_IWOTH)) { 965 seen |= S_IWOTH; 966 if (type == ALLOW) { 967 mode |= S_IWOTH; 968 } 969 } 970 } 971 if ((access_mask & ACE_EXECUTE)) { 972 if (!(seen & S_IXUSR)) { 973 seen |= S_IXUSR; 974 if (type == ALLOW) { 975 mode |= S_IXUSR; 976 } 977 } 978 if (!(seen & S_IXGRP)) { 979 seen |= S_IXGRP; 980 if (type == ALLOW) { 981 mode |= S_IXGRP; 982 } 983 } 984 if (!(seen & S_IXOTH)) { 985 seen |= S_IXOTH; 986 if (type == ALLOW) { 987 mode |= S_IXOTH; 988 } 989 } 990 } 991 } else { 992 /* 993 * Only care if this IDENTIFIER_GROUP or 994 * USER ACE denies execute access to someone, 995 * mode is not affected 996 */ 997 if ((access_mask & ACE_EXECUTE) && type == DENY) 998 an_exec_denied = B_TRUE; 999 } 1000 } 1001 1002 /* 1003 * Failure to allow is effectively a deny, so execute permission 1004 * is denied if it was never mentioned or if we explicitly 1005 * weren't allowed it. 1006 */ 1007 if (!an_exec_denied && 1008 ((seen & ALL_MODE_EXECS) != ALL_MODE_EXECS || 1009 (mode & ALL_MODE_EXECS) != ALL_MODE_EXECS)) 1010 an_exec_denied = B_TRUE; 1011 1012 if (an_exec_denied) 1013 *pflags &= ~ZFS_NO_EXECS_DENIED; 1014 else 1015 *pflags |= ZFS_NO_EXECS_DENIED; 1016 1017 return (mode); 1018 } 1019 1020 /* 1021 * Read an external acl object. If the intent is to modify, always 1022 * create a new acl and leave any cached acl in place. 1023 */ 1024 static int 1025 zfs_acl_node_read(znode_t *zp, zfs_acl_t **aclpp, boolean_t will_modify) 1026 { 1027 zfs_acl_t *aclp; 1028 int aclsize; 1029 int acl_count; 1030 zfs_acl_node_t *aclnode; 1031 zfs_acl_phys_t znode_acl; 1032 int version; 1033 int error; 1034 1035 ASSERT(MUTEX_HELD(&zp->z_acl_lock)); 1036 1037 if (zp->z_acl_cached && !will_modify) { 1038 *aclpp = zp->z_acl_cached; 1039 return (0); 1040 } 1041 1042 version = ZNODE_ACL_VERSION(zp); 1043 1044 if ((error = zfs_acl_znode_info(zp, &aclsize, 1045 &acl_count, &znode_acl)) != 0) 1046 return (error); 1047 1048 aclp = zfs_acl_alloc(version); 1049 1050 aclp->z_acl_count = acl_count; 1051 aclp->z_acl_bytes = aclsize; 1052 1053 aclnode = zfs_acl_node_alloc(aclsize); 1054 aclnode->z_ace_count = aclp->z_acl_count; 1055 aclnode->z_size = aclsize; 1056 1057 if (!zp->z_is_sa) { 1058 if (znode_acl.z_acl_extern_obj) { 1059 error = dmu_read(zp->z_zfsvfs->z_os, 1060 znode_acl.z_acl_extern_obj, 0, aclnode->z_size, 1061 aclnode->z_acldata, DMU_READ_PREFETCH); 1062 } else { 1063 bcopy(znode_acl.z_ace_data, aclnode->z_acldata, 1064 aclnode->z_size); 1065 } 1066 } else { 1067 error = sa_lookup(zp->z_sa_hdl, SA_ZPL_DACL_ACES(zp->z_zfsvfs), 1068 aclnode->z_acldata, aclnode->z_size); 1069 } 1070 1071 if (error != 0) { 1072 zfs_acl_free(aclp); 1073 zfs_acl_node_free(aclnode); 1074 /* convert checksum errors into IO errors */ 1075 if (error == ECKSUM) 1076 error = EIO; 1077 return (error); 1078 } 1079 1080 list_insert_head(&aclp->z_acl, aclnode); 1081 1082 *aclpp = aclp; 1083 if (!will_modify) 1084 zp->z_acl_cached = aclp; 1085 return (0); 1086 } 1087 1088 /*ARGSUSED*/ 1089 void 1090 zfs_acl_data_locator(void **dataptr, uint32_t *length, uint32_t buflen, 1091 boolean_t start, void *userdata) 1092 { 1093 zfs_acl_locator_cb_t *cb = (zfs_acl_locator_cb_t *)userdata; 1094 1095 if (start) { 1096 cb->cb_acl_node = list_head(&cb->cb_aclp->z_acl); 1097 } else { 1098 cb->cb_acl_node = list_next(&cb->cb_aclp->z_acl, 1099 cb->cb_acl_node); 1100 } 1101 *dataptr = cb->cb_acl_node->z_acldata; 1102 *length = cb->cb_acl_node->z_size; 1103 } 1104 1105 /* 1106 * common code for setting ACLs. 1107 * 1108 * This function is called from zfs_mode_update, zfs_perm_init, and zfs_setacl. 1109 * zfs_setacl passes a non-NULL inherit pointer (ihp) to indicate that it's 1110 * already checked the acl and knows whether to inherit. 1111 */ 1112 int 1113 zfs_aclset_common(znode_t *zp, zfs_acl_t *aclp, cred_t *cr, dmu_tx_t *tx) 1114 { 1115 int error; 1116 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 1117 dmu_object_type_t otype; 1118 zfs_acl_locator_cb_t locate = { 0 }; 1119 uint64_t mode; 1120 sa_bulk_attr_t bulk[5]; 1121 uint64_t ctime[2]; 1122 int count = 0; 1123 1124 mode = zp->z_mode; 1125 mode = zfs_mode_compute(mode, aclp, &zp->z_pflags); 1126 1127 zp->z_mode = mode; 1128 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_MODE(zfsvfs), NULL, 1129 &mode, sizeof (mode)); 1130 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_FLAGS(zfsvfs), NULL, 1131 &zp->z_pflags, sizeof (zp->z_pflags)); 1132 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_CTIME(zfsvfs), NULL, 1133 &ctime, sizeof (ctime)); 1134 1135 if (zp->z_acl_cached) { 1136 zfs_acl_free(zp->z_acl_cached); 1137 zp->z_acl_cached = NULL; 1138 } 1139 1140 /* 1141 * Upgrade needed? 1142 */ 1143 if (!zfsvfs->z_use_fuids) { 1144 otype = DMU_OT_OLDACL; 1145 } else { 1146 if ((aclp->z_version == ZFS_ACL_VERSION_INITIAL) && 1147 (zfsvfs->z_version >= ZPL_VERSION_FUID)) 1148 zfs_acl_xform(zp, aclp, cr); 1149 ASSERT(aclp->z_version >= ZFS_ACL_VERSION_FUID); 1150 otype = DMU_OT_ACL; 1151 } 1152 1153 /* 1154 * Arrgh, we have to handle old on disk format 1155 * as well as newer (preferred) SA format. 1156 */ 1157 1158 if (zp->z_is_sa) { /* the easy case, just update the ACL attribute */ 1159 locate.cb_aclp = aclp; 1160 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_DACL_ACES(zfsvfs), 1161 zfs_acl_data_locator, &locate, aclp->z_acl_bytes); 1162 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_DACL_COUNT(zfsvfs), 1163 NULL, &aclp->z_acl_count, sizeof (uint64_t)); 1164 } else { /* Painful legacy way */ 1165 zfs_acl_node_t *aclnode; 1166 uint64_t off = 0; 1167 zfs_acl_phys_t acl_phys; 1168 uint64_t aoid; 1169 1170 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zfsvfs), 1171 &acl_phys, sizeof (acl_phys))) != 0) 1172 return (error); 1173 1174 aoid = acl_phys.z_acl_extern_obj; 1175 1176 if (aclp->z_acl_bytes > ZFS_ACE_SPACE) { 1177 /* 1178 * If ACL was previously external and we are now 1179 * converting to new ACL format then release old 1180 * ACL object and create a new one. 1181 */ 1182 if (aoid && 1183 aclp->z_version != acl_phys.z_acl_version) { 1184 error = dmu_object_free(zfsvfs->z_os, aoid, tx); 1185 if (error) 1186 return (error); 1187 aoid = 0; 1188 } 1189 if (aoid == 0) { 1190 aoid = dmu_object_alloc(zfsvfs->z_os, 1191 otype, aclp->z_acl_bytes, 1192 otype == DMU_OT_ACL ? 1193 DMU_OT_SYSACL : DMU_OT_NONE, 1194 otype == DMU_OT_ACL ? 1195 DN_MAX_BONUSLEN : 0, tx); 1196 } else { 1197 (void) dmu_object_set_blocksize(zfsvfs->z_os, 1198 aoid, aclp->z_acl_bytes, 0, tx); 1199 } 1200 acl_phys.z_acl_extern_obj = aoid; 1201 for (aclnode = list_head(&aclp->z_acl); aclnode; 1202 aclnode = list_next(&aclp->z_acl, aclnode)) { 1203 if (aclnode->z_ace_count == 0) 1204 continue; 1205 dmu_write(zfsvfs->z_os, aoid, off, 1206 aclnode->z_size, aclnode->z_acldata, tx); 1207 off += aclnode->z_size; 1208 } 1209 } else { 1210 void *start = acl_phys.z_ace_data; 1211 /* 1212 * Migrating back embedded? 1213 */ 1214 if (acl_phys.z_acl_extern_obj) { 1215 error = dmu_object_free(zfsvfs->z_os, 1216 acl_phys.z_acl_extern_obj, tx); 1217 if (error) 1218 return (error); 1219 acl_phys.z_acl_extern_obj = 0; 1220 } 1221 1222 for (aclnode = list_head(&aclp->z_acl); aclnode; 1223 aclnode = list_next(&aclp->z_acl, aclnode)) { 1224 if (aclnode->z_ace_count == 0) 1225 continue; 1226 bcopy(aclnode->z_acldata, start, 1227 aclnode->z_size); 1228 start = (caddr_t)start + aclnode->z_size; 1229 } 1230 } 1231 /* 1232 * If Old version then swap count/bytes to match old 1233 * layout of znode_acl_phys_t. 1234 */ 1235 if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) { 1236 acl_phys.z_acl_size = aclp->z_acl_count; 1237 acl_phys.z_acl_count = aclp->z_acl_bytes; 1238 } else { 1239 acl_phys.z_acl_size = aclp->z_acl_bytes; 1240 acl_phys.z_acl_count = aclp->z_acl_count; 1241 } 1242 acl_phys.z_acl_version = aclp->z_version; 1243 1244 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_ZNODE_ACL(zfsvfs), NULL, 1245 &acl_phys, sizeof (acl_phys)); 1246 } 1247 1248 /* 1249 * Replace ACL wide bits, but first clear them. 1250 */ 1251 zp->z_pflags &= ~ZFS_ACL_WIDE_FLAGS; 1252 1253 zp->z_pflags |= aclp->z_hints; 1254 1255 if (ace_trivial_common(aclp, 0, zfs_ace_walk) == 0) 1256 zp->z_pflags |= ZFS_ACL_TRIVIAL; 1257 1258 zfs_tstamp_update_setup(zp, STATE_CHANGED, NULL, ctime, B_TRUE); 1259 return (sa_bulk_update(zp->z_sa_hdl, bulk, count, tx)); 1260 } 1261 1262 /* 1263 * Update access mask for prepended ACE 1264 * 1265 * This applies the "groupmask" value for aclmode property. 1266 */ 1267 static void 1268 zfs_acl_prepend_fixup(zfs_acl_t *aclp, void *acep, void *origacep, 1269 mode_t mode, uint64_t owner) 1270 { 1271 int rmask, wmask, xmask; 1272 int user_ace; 1273 uint16_t aceflags; 1274 uint32_t origmask, acepmask; 1275 uint64_t fuid; 1276 1277 aceflags = aclp->z_ops.ace_flags_get(acep); 1278 fuid = aclp->z_ops.ace_who_get(acep); 1279 origmask = aclp->z_ops.ace_mask_get(origacep); 1280 acepmask = aclp->z_ops.ace_mask_get(acep); 1281 1282 user_ace = (!(aceflags & 1283 (ACE_OWNER|ACE_GROUP|ACE_IDENTIFIER_GROUP))); 1284 1285 if (user_ace && (fuid == owner)) { 1286 rmask = S_IRUSR; 1287 wmask = S_IWUSR; 1288 xmask = S_IXUSR; 1289 } else { 1290 rmask = S_IRGRP; 1291 wmask = S_IWGRP; 1292 xmask = S_IXGRP; 1293 } 1294 1295 if (origmask & ACE_READ_DATA) { 1296 if (mode & rmask) { 1297 acepmask &= ~ACE_READ_DATA; 1298 } else { 1299 acepmask |= ACE_READ_DATA; 1300 } 1301 } 1302 1303 if (origmask & ACE_WRITE_DATA) { 1304 if (mode & wmask) { 1305 acepmask &= ~ACE_WRITE_DATA; 1306 } else { 1307 acepmask |= ACE_WRITE_DATA; 1308 } 1309 } 1310 1311 if (origmask & ACE_APPEND_DATA) { 1312 if (mode & wmask) { 1313 acepmask &= ~ACE_APPEND_DATA; 1314 } else { 1315 acepmask |= ACE_APPEND_DATA; 1316 } 1317 } 1318 1319 if (origmask & ACE_EXECUTE) { 1320 if (mode & xmask) { 1321 acepmask &= ~ACE_EXECUTE; 1322 } else { 1323 acepmask |= ACE_EXECUTE; 1324 } 1325 } 1326 aclp->z_ops.ace_mask_set(acep, acepmask); 1327 } 1328 1329 /* 1330 * Apply mode to canonical six ACEs. 1331 */ 1332 static void 1333 zfs_acl_fixup_canonical_six(zfs_acl_t *aclp, mode_t mode) 1334 { 1335 zfs_acl_node_t *aclnode = list_tail(&aclp->z_acl); 1336 void *acep; 1337 int maskoff = aclp->z_ops.ace_mask_off(); 1338 size_t abstract_size = aclp->z_ops.ace_abstract_size(); 1339 1340 ASSERT(aclnode != NULL); 1341 1342 acep = (void *)((caddr_t)aclnode->z_acldata + 1343 aclnode->z_size - (abstract_size * 6)); 1344 1345 /* 1346 * Fixup final ACEs to match the mode 1347 */ 1348 1349 adjust_ace_pair_common(acep, maskoff, abstract_size, 1350 (mode & 0700) >> 6); /* owner@ */ 1351 1352 acep = (caddr_t)acep + (abstract_size * 2); 1353 1354 adjust_ace_pair_common(acep, maskoff, abstract_size, 1355 (mode & 0070) >> 3); /* group@ */ 1356 1357 acep = (caddr_t)acep + (abstract_size * 2); 1358 adjust_ace_pair_common(acep, maskoff, 1359 abstract_size, mode); /* everyone@ */ 1360 } 1361 1362 1363 static int 1364 zfs_acl_ace_match(zfs_acl_t *aclp, void *acep, int allow_deny, 1365 int entry_type, int accessmask) 1366 { 1367 uint32_t mask = aclp->z_ops.ace_mask_get(acep); 1368 uint16_t type = aclp->z_ops.ace_type_get(acep); 1369 uint16_t flags = aclp->z_ops.ace_flags_get(acep); 1370 1371 return (mask == accessmask && type == allow_deny && 1372 ((flags & ACE_TYPE_FLAGS) == entry_type)); 1373 } 1374 1375 /* 1376 * Can prepended ACE be reused? 1377 */ 1378 static int 1379 zfs_reuse_deny(zfs_acl_t *aclp, void *acep, void *prevacep) 1380 { 1381 int okay_masks; 1382 uint16_t prevtype; 1383 uint16_t prevflags; 1384 uint16_t flags; 1385 uint32_t mask, prevmask; 1386 1387 if (prevacep == NULL) 1388 return (B_FALSE); 1389 1390 prevtype = aclp->z_ops.ace_type_get(prevacep); 1391 prevflags = aclp->z_ops.ace_flags_get(prevacep); 1392 flags = aclp->z_ops.ace_flags_get(acep); 1393 mask = aclp->z_ops.ace_mask_get(acep); 1394 prevmask = aclp->z_ops.ace_mask_get(prevacep); 1395 1396 if (prevtype != DENY) 1397 return (B_FALSE); 1398 1399 if (prevflags != (flags & ACE_IDENTIFIER_GROUP)) 1400 return (B_FALSE); 1401 1402 okay_masks = (mask & OKAY_MASK_BITS); 1403 1404 if (prevmask & ~okay_masks) 1405 return (B_FALSE); 1406 1407 return (B_TRUE); 1408 } 1409 1410 1411 /* 1412 * Insert new ACL node into chain of zfs_acl_node_t's 1413 * 1414 * This will result in two possible results. 1415 * 1. If the ACL is currently just a single zfs_acl_node and 1416 * we are prepending the entry then current acl node will have 1417 * a new node inserted above it. 1418 * 1419 * 2. If we are inserting in the middle of current acl node then 1420 * the current node will be split in two and new node will be inserted 1421 * in between the two split nodes. 1422 */ 1423 static zfs_acl_node_t * 1424 zfs_acl_ace_insert(zfs_acl_t *aclp, void *acep) 1425 { 1426 zfs_acl_node_t *newnode; 1427 zfs_acl_node_t *trailernode = NULL; 1428 zfs_acl_node_t *currnode = zfs_acl_curr_node(aclp); 1429 int curr_idx = aclp->z_curr_node->z_ace_idx; 1430 int trailer_count; 1431 size_t oldsize; 1432 1433 newnode = zfs_acl_node_alloc(aclp->z_ops.ace_size(acep)); 1434 newnode->z_ace_count = 1; 1435 1436 oldsize = currnode->z_size; 1437 1438 if (curr_idx != 1) { 1439 trailernode = zfs_acl_node_alloc(0); 1440 trailernode->z_acldata = acep; 1441 1442 trailer_count = currnode->z_ace_count - curr_idx + 1; 1443 currnode->z_ace_count = curr_idx - 1; 1444 currnode->z_size = (caddr_t)acep - (caddr_t)currnode->z_acldata; 1445 trailernode->z_size = oldsize - currnode->z_size; 1446 trailernode->z_ace_count = trailer_count; 1447 } 1448 1449 aclp->z_acl_count += 1; 1450 aclp->z_acl_bytes += aclp->z_ops.ace_size(acep); 1451 1452 if (curr_idx == 1) 1453 list_insert_before(&aclp->z_acl, currnode, newnode); 1454 else 1455 list_insert_after(&aclp->z_acl, currnode, newnode); 1456 if (trailernode) { 1457 list_insert_after(&aclp->z_acl, newnode, trailernode); 1458 aclp->z_curr_node = trailernode; 1459 trailernode->z_ace_idx = 1; 1460 } 1461 1462 return (newnode); 1463 } 1464 1465 /* 1466 * Prepend deny ACE 1467 */ 1468 static void * 1469 zfs_acl_prepend_deny(uint64_t uid, zfs_acl_t *aclp, void *acep, 1470 mode_t mode) 1471 { 1472 zfs_acl_node_t *aclnode; 1473 void *newacep; 1474 uint64_t fuid; 1475 uint16_t flags; 1476 1477 aclnode = zfs_acl_ace_insert(aclp, acep); 1478 newacep = aclnode->z_acldata; 1479 fuid = aclp->z_ops.ace_who_get(acep); 1480 flags = aclp->z_ops.ace_flags_get(acep); 1481 zfs_set_ace(aclp, newacep, 0, DENY, fuid, (flags & ACE_TYPE_FLAGS)); 1482 zfs_acl_prepend_fixup(aclp, newacep, acep, mode, uid); 1483 1484 return (newacep); 1485 } 1486 1487 /* 1488 * Split an inherited ACE into inherit_only ACE 1489 * and original ACE with inheritance flags stripped off. 1490 */ 1491 static void 1492 zfs_acl_split_ace(zfs_acl_t *aclp, zfs_ace_hdr_t *acep) 1493 { 1494 zfs_acl_node_t *aclnode; 1495 zfs_acl_node_t *currnode; 1496 void *newacep; 1497 uint16_t type, flags; 1498 uint32_t mask; 1499 uint64_t fuid; 1500 1501 type = aclp->z_ops.ace_type_get(acep); 1502 flags = aclp->z_ops.ace_flags_get(acep); 1503 mask = aclp->z_ops.ace_mask_get(acep); 1504 fuid = aclp->z_ops.ace_who_get(acep); 1505 1506 aclnode = zfs_acl_ace_insert(aclp, acep); 1507 newacep = aclnode->z_acldata; 1508 1509 aclp->z_ops.ace_type_set(newacep, type); 1510 aclp->z_ops.ace_flags_set(newacep, flags | ACE_INHERIT_ONLY_ACE); 1511 aclp->z_ops.ace_mask_set(newacep, mask); 1512 aclp->z_ops.ace_type_set(newacep, type); 1513 aclp->z_ops.ace_who_set(newacep, fuid); 1514 aclp->z_next_ace = acep; 1515 flags &= ~ALL_INHERIT; 1516 aclp->z_ops.ace_flags_set(acep, flags); 1517 currnode = zfs_acl_curr_node(aclp); 1518 ASSERT(currnode->z_ace_idx >= 1); 1519 currnode->z_ace_idx -= 1; 1520 } 1521 1522 /* 1523 * Are ACES started at index i, the canonical six ACES? 1524 */ 1525 static int 1526 zfs_have_canonical_six(zfs_acl_t *aclp) 1527 { 1528 void *acep; 1529 zfs_acl_node_t *aclnode = list_tail(&aclp->z_acl); 1530 int i = 0; 1531 size_t abstract_size = aclp->z_ops.ace_abstract_size(); 1532 1533 ASSERT(aclnode != NULL); 1534 1535 if (aclnode->z_ace_count < 6) 1536 return (0); 1537 1538 acep = (void *)((caddr_t)aclnode->z_acldata + 1539 aclnode->z_size - (aclp->z_ops.ace_abstract_size() * 6)); 1540 1541 if ((zfs_acl_ace_match(aclp, (caddr_t)acep + (abstract_size * i++), 1542 DENY, ACE_OWNER, 0) && 1543 zfs_acl_ace_match(aclp, (caddr_t)acep + (abstract_size * i++), 1544 ALLOW, ACE_OWNER, OWNER_ALLOW_MASK) && 1545 zfs_acl_ace_match(aclp, (caddr_t)acep + (abstract_size * i++), DENY, 1546 OWNING_GROUP, 0) && zfs_acl_ace_match(aclp, (caddr_t)acep + 1547 (abstract_size * i++), 1548 ALLOW, OWNING_GROUP, 0) && 1549 zfs_acl_ace_match(aclp, (caddr_t)acep + (abstract_size * i++), 1550 DENY, ACE_EVERYONE, EVERYONE_DENY_MASK) && 1551 zfs_acl_ace_match(aclp, (caddr_t)acep + (abstract_size * i++), 1552 ALLOW, ACE_EVERYONE, EVERYONE_ALLOW_MASK))) { 1553 return (1); 1554 } else { 1555 return (0); 1556 } 1557 } 1558 1559 1560 /* 1561 * Apply step 1g, to group entries 1562 * 1563 * Need to deal with corner case where group may have 1564 * greater permissions than owner. If so then limit 1565 * group permissions, based on what extra permissions 1566 * group has. 1567 */ 1568 static void 1569 zfs_fixup_group_entries(zfs_acl_t *aclp, void *acep, void *prevacep, 1570 mode_t mode) 1571 { 1572 uint32_t prevmask = aclp->z_ops.ace_mask_get(prevacep); 1573 uint32_t mask = aclp->z_ops.ace_mask_get(acep); 1574 uint16_t prevflags = aclp->z_ops.ace_flags_get(prevacep); 1575 mode_t extramode = (mode >> 3) & 07; 1576 mode_t ownermode = (mode >> 6); 1577 1578 if (prevflags & ACE_IDENTIFIER_GROUP) { 1579 1580 extramode &= ~ownermode; 1581 1582 if (extramode) { 1583 if (extramode & S_IROTH) { 1584 prevmask &= ~ACE_READ_DATA; 1585 mask &= ~ACE_READ_DATA; 1586 } 1587 if (extramode & S_IWOTH) { 1588 prevmask &= ~(ACE_WRITE_DATA|ACE_APPEND_DATA); 1589 mask &= ~(ACE_WRITE_DATA|ACE_APPEND_DATA); 1590 } 1591 if (extramode & S_IXOTH) { 1592 prevmask &= ~ACE_EXECUTE; 1593 mask &= ~ACE_EXECUTE; 1594 } 1595 } 1596 } 1597 aclp->z_ops.ace_mask_set(acep, mask); 1598 aclp->z_ops.ace_mask_set(prevacep, prevmask); 1599 } 1600 1601 /* 1602 * Apply the chmod algorithm as described 1603 * in PSARC/2002/240 1604 */ 1605 static void 1606 zfs_acl_chmod(zfsvfs_t *zfsvfs, uint64_t uid, 1607 uint64_t mode, zfs_acl_t *aclp) 1608 { 1609 void *acep = NULL, *prevacep = NULL; 1610 uint64_t who; 1611 int i; 1612 int entry_type; 1613 int reuse_deny; 1614 int need_canonical_six = 1; 1615 uint16_t iflags, type; 1616 uint32_t access_mask; 1617 1618 /* 1619 * If discard then just discard all ACL nodes which 1620 * represent the ACEs. 1621 * 1622 * New owner@/group@/everone@ ACEs will be added 1623 * later. 1624 */ 1625 if (zfsvfs->z_acl_mode == ZFS_ACL_DISCARD) 1626 zfs_acl_release_nodes(aclp); 1627 1628 while (acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask, 1629 &iflags, &type)) { 1630 1631 entry_type = (iflags & ACE_TYPE_FLAGS); 1632 iflags = (iflags & ALL_INHERIT); 1633 1634 if ((type != ALLOW && type != DENY) || 1635 (iflags & ACE_INHERIT_ONLY_ACE)) { 1636 if (iflags) 1637 aclp->z_hints |= ZFS_INHERIT_ACE; 1638 switch (type) { 1639 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 1640 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 1641 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 1642 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 1643 aclp->z_hints |= ZFS_ACL_OBJ_ACE; 1644 break; 1645 } 1646 goto nextace; 1647 } 1648 1649 /* 1650 * Need to split ace into two? 1651 */ 1652 if ((iflags & (ACE_FILE_INHERIT_ACE| 1653 ACE_DIRECTORY_INHERIT_ACE)) && 1654 (!(iflags & ACE_INHERIT_ONLY_ACE))) { 1655 zfs_acl_split_ace(aclp, acep); 1656 aclp->z_hints |= ZFS_INHERIT_ACE; 1657 goto nextace; 1658 } 1659 1660 if (entry_type == ACE_OWNER || entry_type == ACE_EVERYONE || 1661 (entry_type == OWNING_GROUP)) { 1662 access_mask &= ~OGE_CLEAR; 1663 aclp->z_ops.ace_mask_set(acep, access_mask); 1664 goto nextace; 1665 } else { 1666 reuse_deny = B_TRUE; 1667 if (type == ALLOW) { 1668 1669 /* 1670 * Check preceding ACE if any, to see 1671 * if we need to prepend a DENY ACE. 1672 * This is only applicable when the acl_mode 1673 * property == groupmask. 1674 */ 1675 if (zfsvfs->z_acl_mode == ZFS_ACL_GROUPMASK) { 1676 1677 reuse_deny = zfs_reuse_deny(aclp, acep, 1678 prevacep); 1679 1680 if (!reuse_deny) { 1681 prevacep = 1682 zfs_acl_prepend_deny(uid, 1683 aclp, acep, mode); 1684 } else { 1685 zfs_acl_prepend_fixup( 1686 aclp, prevacep, 1687 acep, mode, uid); 1688 } 1689 zfs_fixup_group_entries(aclp, acep, 1690 prevacep, mode); 1691 } 1692 } 1693 } 1694 nextace: 1695 prevacep = acep; 1696 } 1697 1698 /* 1699 * Check out last six aces, if we have six. 1700 */ 1701 1702 if (aclp->z_acl_count >= 6) { 1703 if (zfs_have_canonical_six(aclp)) { 1704 need_canonical_six = 0; 1705 } 1706 } 1707 1708 if (need_canonical_six) { 1709 size_t abstract_size = aclp->z_ops.ace_abstract_size(); 1710 void *zacep; 1711 zfs_acl_node_t *aclnode = 1712 zfs_acl_node_alloc(abstract_size * 6); 1713 1714 aclnode->z_size = abstract_size * 6; 1715 aclnode->z_ace_count = 6; 1716 aclp->z_acl_bytes += aclnode->z_size; 1717 list_insert_tail(&aclp->z_acl, aclnode); 1718 1719 zacep = aclnode->z_acldata; 1720 1721 i = 0; 1722 zfs_set_ace(aclp, (caddr_t)zacep + (abstract_size * i++), 1723 0, DENY, -1, ACE_OWNER); 1724 zfs_set_ace(aclp, (caddr_t)zacep + (abstract_size * i++), 1725 OWNER_ALLOW_MASK, ALLOW, -1, ACE_OWNER); 1726 zfs_set_ace(aclp, (caddr_t)zacep + (abstract_size * i++), 0, 1727 DENY, -1, OWNING_GROUP); 1728 zfs_set_ace(aclp, (caddr_t)zacep + (abstract_size * i++), 0, 1729 ALLOW, -1, OWNING_GROUP); 1730 zfs_set_ace(aclp, (caddr_t)zacep + (abstract_size * i++), 1731 EVERYONE_DENY_MASK, DENY, -1, ACE_EVERYONE); 1732 zfs_set_ace(aclp, (caddr_t)zacep + (abstract_size * i++), 1733 EVERYONE_ALLOW_MASK, ALLOW, -1, ACE_EVERYONE); 1734 aclp->z_acl_count += 6; 1735 } 1736 1737 zfs_acl_fixup_canonical_six(aclp, mode); 1738 } 1739 1740 int 1741 zfs_acl_chmod_setattr(znode_t *zp, zfs_acl_t **aclp, uint64_t mode) 1742 { 1743 int error; 1744 1745 mutex_enter(&zp->z_lock); 1746 mutex_enter(&zp->z_acl_lock); 1747 1748 *aclp = NULL; 1749 error = zfs_acl_node_read(zp, aclp, B_TRUE); 1750 if (error == 0) { 1751 uint64_t owner; 1752 if (IS_EPHEMERAL(zp->z_uid)) 1753 if ((error = sa_lookup(zp->z_sa_hdl, 1754 SA_ZPL_UID(zp->z_zfsvfs), 1755 &owner, sizeof (owner))) != 0) 1756 return (error); 1757 else 1758 owner = (uint64_t)zp->z_uid; 1759 (*aclp)->z_hints = zp->z_pflags & V4_ACL_WIDE_FLAGS; 1760 zfs_acl_chmod(zp->z_zfsvfs, owner, mode, *aclp); 1761 } 1762 mutex_exit(&zp->z_acl_lock); 1763 mutex_exit(&zp->z_lock); 1764 return (error); 1765 } 1766 1767 /* 1768 * strip off write_owner and write_acl 1769 */ 1770 static void 1771 zfs_restricted_update(zfsvfs_t *zfsvfs, zfs_acl_t *aclp, void *acep) 1772 { 1773 uint32_t mask = aclp->z_ops.ace_mask_get(acep); 1774 1775 if ((zfsvfs->z_acl_inherit == ZFS_ACL_RESTRICTED) && 1776 (aclp->z_ops.ace_type_get(acep) == ALLOW)) { 1777 mask &= ~RESTRICTED_CLEAR; 1778 aclp->z_ops.ace_mask_set(acep, mask); 1779 } 1780 } 1781 1782 /* 1783 * Should ACE be inherited? 1784 */ 1785 static int 1786 zfs_ace_can_use(vtype_t vtype, uint16_t acep_flags) 1787 { 1788 int iflags = (acep_flags & 0xf); 1789 1790 if ((vtype == VDIR) && (iflags & ACE_DIRECTORY_INHERIT_ACE)) 1791 return (1); 1792 else if (iflags & ACE_FILE_INHERIT_ACE) 1793 return (!((vtype == VDIR) && 1794 (iflags & ACE_NO_PROPAGATE_INHERIT_ACE))); 1795 return (0); 1796 } 1797 1798 /* 1799 * inherit inheritable ACEs from parent 1800 */ 1801 static zfs_acl_t * 1802 zfs_acl_inherit(zfsvfs_t *zfsvfs, vtype_t vtype, zfs_acl_t *paclp, 1803 uint64_t mode, boolean_t *need_chmod) 1804 { 1805 void *pacep; 1806 void *acep, *acep2; 1807 zfs_acl_node_t *aclnode, *aclnode2; 1808 zfs_acl_t *aclp = NULL; 1809 uint64_t who; 1810 uint32_t access_mask; 1811 uint16_t iflags, newflags, type; 1812 size_t ace_size; 1813 void *data1, *data2; 1814 size_t data1sz, data2sz; 1815 boolean_t vdir = vtype == VDIR; 1816 boolean_t vreg = vtype == VREG; 1817 boolean_t passthrough, passthrough_x, noallow; 1818 1819 passthrough_x = 1820 zfsvfs->z_acl_inherit == ZFS_ACL_PASSTHROUGH_X; 1821 passthrough = passthrough_x || 1822 zfsvfs->z_acl_inherit == ZFS_ACL_PASSTHROUGH; 1823 noallow = 1824 zfsvfs->z_acl_inherit == ZFS_ACL_NOALLOW; 1825 1826 *need_chmod = B_TRUE; 1827 pacep = NULL; 1828 aclp = zfs_acl_alloc(paclp->z_version); 1829 if (zfsvfs->z_acl_inherit == ZFS_ACL_DISCARD || vtype == VLNK) 1830 return (aclp); 1831 while (pacep = zfs_acl_next_ace(paclp, pacep, &who, 1832 &access_mask, &iflags, &type)) { 1833 1834 /* 1835 * don't inherit bogus ACEs 1836 */ 1837 if (!zfs_acl_valid_ace_type(type, iflags)) 1838 continue; 1839 1840 if (noallow && type == ALLOW) 1841 continue; 1842 1843 ace_size = aclp->z_ops.ace_size(pacep); 1844 1845 if (!zfs_ace_can_use(vtype, iflags)) 1846 continue; 1847 1848 /* 1849 * If owner@, group@, or everyone@ inheritable 1850 * then zfs_acl_chmod() isn't needed. 1851 */ 1852 if (passthrough && 1853 ((iflags & (ACE_OWNER|ACE_EVERYONE)) || 1854 ((iflags & OWNING_GROUP) == 1855 OWNING_GROUP)) && (vreg || (vdir && (iflags & 1856 ACE_DIRECTORY_INHERIT_ACE)))) { 1857 *need_chmod = B_FALSE; 1858 1859 if (!vdir && passthrough_x && 1860 ((mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0)) { 1861 access_mask &= ~ACE_EXECUTE; 1862 } 1863 } 1864 1865 aclnode = zfs_acl_node_alloc(ace_size); 1866 list_insert_tail(&aclp->z_acl, aclnode); 1867 acep = aclnode->z_acldata; 1868 1869 zfs_set_ace(aclp, acep, access_mask, type, 1870 who, iflags|ACE_INHERITED_ACE); 1871 1872 /* 1873 * Copy special opaque data if any 1874 */ 1875 if ((data1sz = paclp->z_ops.ace_data(pacep, &data1)) != 0) { 1876 VERIFY((data2sz = aclp->z_ops.ace_data(acep, 1877 &data2)) == data1sz); 1878 bcopy(data1, data2, data2sz); 1879 } 1880 aclp->z_acl_count++; 1881 aclnode->z_ace_count++; 1882 aclp->z_acl_bytes += aclnode->z_size; 1883 newflags = aclp->z_ops.ace_flags_get(acep); 1884 1885 if (vdir) 1886 aclp->z_hints |= ZFS_INHERIT_ACE; 1887 1888 if ((iflags & ACE_NO_PROPAGATE_INHERIT_ACE) || !vdir) { 1889 newflags &= ~ALL_INHERIT; 1890 aclp->z_ops.ace_flags_set(acep, 1891 newflags|ACE_INHERITED_ACE); 1892 zfs_restricted_update(zfsvfs, aclp, acep); 1893 continue; 1894 } 1895 1896 ASSERT(vdir); 1897 1898 newflags = aclp->z_ops.ace_flags_get(acep); 1899 if ((iflags & (ACE_FILE_INHERIT_ACE | 1900 ACE_DIRECTORY_INHERIT_ACE)) != 1901 ACE_FILE_INHERIT_ACE) { 1902 aclnode2 = zfs_acl_node_alloc(ace_size); 1903 list_insert_tail(&aclp->z_acl, aclnode2); 1904 acep2 = aclnode2->z_acldata; 1905 zfs_set_ace(aclp, acep2, 1906 access_mask, type, who, 1907 iflags|ACE_INHERITED_ACE); 1908 newflags |= ACE_INHERIT_ONLY_ACE; 1909 aclp->z_ops.ace_flags_set(acep, newflags); 1910 newflags &= ~ALL_INHERIT; 1911 aclp->z_ops.ace_flags_set(acep2, 1912 newflags|ACE_INHERITED_ACE); 1913 1914 /* 1915 * Copy special opaque data if any 1916 */ 1917 if ((data1sz = aclp->z_ops.ace_data(acep, 1918 &data1)) != 0) { 1919 VERIFY((data2sz = 1920 aclp->z_ops.ace_data(acep2, 1921 &data2)) == data1sz); 1922 bcopy(data1, data2, data1sz); 1923 } 1924 aclp->z_acl_count++; 1925 aclnode2->z_ace_count++; 1926 aclp->z_acl_bytes += aclnode->z_size; 1927 zfs_restricted_update(zfsvfs, aclp, acep2); 1928 } else { 1929 newflags |= ACE_INHERIT_ONLY_ACE; 1930 aclp->z_ops.ace_flags_set(acep, 1931 newflags|ACE_INHERITED_ACE); 1932 } 1933 } 1934 return (aclp); 1935 } 1936 1937 /* 1938 * Create file system object initial permissions 1939 * including inheritable ACEs. 1940 */ 1941 int 1942 zfs_acl_ids_create(znode_t *dzp, int flag, vattr_t *vap, cred_t *cr, 1943 vsecattr_t *vsecp, zfs_acl_ids_t *acl_ids) 1944 { 1945 int error; 1946 zfsvfs_t *zfsvfs = dzp->z_zfsvfs; 1947 zfs_acl_t *paclp; 1948 gid_t gid; 1949 boolean_t need_chmod = B_TRUE; 1950 boolean_t inherited = B_FALSE; 1951 uint64_t parentgid; 1952 1953 bzero(acl_ids, sizeof (zfs_acl_ids_t)); 1954 acl_ids->z_mode = MAKEIMODE(vap->va_type, vap->va_mode); 1955 1956 if (vsecp) 1957 if ((error = zfs_vsec_2_aclp(zfsvfs, vap->va_type, vsecp, cr, 1958 &acl_ids->z_fuidp, &acl_ids->z_aclp)) != 0) 1959 return (error); 1960 /* 1961 * Determine uid and gid. 1962 */ 1963 if ((flag & IS_ROOT_NODE) || zfsvfs->z_replay || 1964 ((flag & IS_XATTR) && (vap->va_type == VDIR))) { 1965 acl_ids->z_fuid = zfs_fuid_create(zfsvfs, 1966 (uint64_t)vap->va_uid, cr, 1967 ZFS_OWNER, &acl_ids->z_fuidp); 1968 acl_ids->z_fgid = zfs_fuid_create(zfsvfs, 1969 (uint64_t)vap->va_gid, cr, 1970 ZFS_GROUP, &acl_ids->z_fuidp); 1971 gid = vap->va_gid; 1972 } else { 1973 if (IS_EPHEMERAL(dzp->z_gid)) 1974 VERIFY(0 == sa_lookup(dzp->z_sa_hdl, SA_ZPL_GID(zfsvfs), 1975 &parentgid, sizeof (parentgid))); 1976 else 1977 parentgid = (uint64_t)dzp->z_gid; 1978 1979 acl_ids->z_fuid = zfs_fuid_create_cred(zfsvfs, ZFS_OWNER, 1980 cr, &acl_ids->z_fuidp); 1981 acl_ids->z_fgid = 0; 1982 if (vap->va_mask & AT_GID) { 1983 acl_ids->z_fgid = zfs_fuid_create(zfsvfs, 1984 (uint64_t)vap->va_gid, 1985 cr, ZFS_GROUP, &acl_ids->z_fuidp); 1986 gid = vap->va_gid; 1987 if (acl_ids->z_fgid != parentgid && 1988 !groupmember(vap->va_gid, cr) && 1989 secpolicy_vnode_create_gid(cr) != 0) 1990 acl_ids->z_fgid = 0; 1991 } 1992 if (acl_ids->z_fgid == 0) { 1993 if (dzp->z_mode & S_ISGID) { 1994 char *domain; 1995 uint32_t rid; 1996 1997 acl_ids->z_fgid = parentgid; 1998 gid = zfs_fuid_map_id(zfsvfs, acl_ids->z_fgid, 1999 cr, ZFS_GROUP); 2000 2001 if (zfsvfs->z_use_fuids && 2002 IS_EPHEMERAL(acl_ids->z_fgid)) { 2003 domain = zfs_fuid_idx_domain( 2004 &zfsvfs->z_fuid_idx, 2005 FUID_INDEX(acl_ids->z_fgid)); 2006 rid = FUID_RID(acl_ids->z_fgid); 2007 zfs_fuid_node_add(&acl_ids->z_fuidp, 2008 domain, rid, 2009 FUID_INDEX(acl_ids->z_fgid), 2010 acl_ids->z_fgid, ZFS_GROUP); 2011 } 2012 } else { 2013 acl_ids->z_fgid = zfs_fuid_create_cred(zfsvfs, 2014 ZFS_GROUP, cr, &acl_ids->z_fuidp); 2015 gid = crgetgid(cr); 2016 } 2017 } 2018 } 2019 2020 /* 2021 * If we're creating a directory, and the parent directory has the 2022 * set-GID bit set, set in on the new directory. 2023 * Otherwise, if the user is neither privileged nor a member of the 2024 * file's new group, clear the file's set-GID bit. 2025 */ 2026 2027 if (!(flag & IS_ROOT_NODE) && (dzp->z_mode & S_ISGID) && 2028 (vap->va_type == VDIR)) { 2029 acl_ids->z_mode |= S_ISGID; 2030 } else { 2031 if ((acl_ids->z_mode & S_ISGID) && 2032 secpolicy_vnode_setids_setgids(cr, gid) != 0) 2033 acl_ids->z_mode &= ~S_ISGID; 2034 } 2035 2036 if (acl_ids->z_aclp == NULL) { 2037 mutex_enter(&dzp->z_lock); 2038 if (!(flag & IS_ROOT_NODE) && (ZTOV(dzp)->v_type == VDIR && 2039 (dzp->z_pflags & ZFS_INHERIT_ACE)) && 2040 !(dzp->z_pflags & ZFS_XATTR)) { 2041 mutex_enter(&dzp->z_acl_lock); 2042 VERIFY(0 == zfs_acl_node_read(dzp, &paclp, B_FALSE)); 2043 acl_ids->z_aclp = zfs_acl_inherit(zfsvfs, 2044 vap->va_type, paclp, acl_ids->z_mode, &need_chmod); 2045 mutex_exit(&dzp->z_acl_lock); 2046 inherited = B_TRUE; 2047 } else { 2048 acl_ids->z_aclp = 2049 zfs_acl_alloc(zfs_acl_version_zp(dzp)); 2050 acl_ids->z_aclp->z_hints |= ZFS_ACL_TRIVIAL; 2051 } 2052 mutex_exit(&dzp->z_lock); 2053 if (need_chmod) { 2054 acl_ids->z_aclp->z_hints |= (vap->va_type == VDIR) ? 2055 ZFS_ACL_AUTO_INHERIT : 0; 2056 zfs_acl_chmod(zfsvfs, acl_ids->z_fuid, 2057 acl_ids->z_mode, acl_ids->z_aclp); 2058 } 2059 } 2060 2061 if (inherited || vsecp) { 2062 acl_ids->z_mode = zfs_mode_compute(acl_ids->z_mode, 2063 acl_ids->z_aclp, &acl_ids->z_aclp->z_hints); 2064 if (ace_trivial_common(acl_ids->z_aclp, 0, zfs_ace_walk) == 0) 2065 acl_ids->z_aclp->z_hints |= ZFS_ACL_TRIVIAL; 2066 } 2067 2068 return (0); 2069 } 2070 2071 /* 2072 * Free ACL and fuid_infop, but not the acl_ids structure 2073 */ 2074 void 2075 zfs_acl_ids_free(zfs_acl_ids_t *acl_ids) 2076 { 2077 if (acl_ids->z_aclp) 2078 zfs_acl_free(acl_ids->z_aclp); 2079 if (acl_ids->z_fuidp) 2080 zfs_fuid_info_free(acl_ids->z_fuidp); 2081 acl_ids->z_aclp = NULL; 2082 acl_ids->z_fuidp = NULL; 2083 } 2084 2085 boolean_t 2086 zfs_acl_ids_overquota(zfsvfs_t *zfsvfs, zfs_acl_ids_t *acl_ids) 2087 { 2088 return (zfs_fuid_overquota(zfsvfs, B_FALSE, acl_ids->z_fuid) || 2089 zfs_fuid_overquota(zfsvfs, B_TRUE, acl_ids->z_fgid)); 2090 } 2091 2092 /* 2093 * Retrieve a files ACL 2094 */ 2095 int 2096 zfs_getacl(znode_t *zp, vsecattr_t *vsecp, boolean_t skipaclchk, cred_t *cr) 2097 { 2098 zfs_acl_t *aclp; 2099 ulong_t mask; 2100 int error; 2101 int count = 0; 2102 int largeace = 0; 2103 2104 mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT | 2105 VSA_ACE_ACLFLAGS | VSA_ACE_ALLTYPES); 2106 2107 if (mask == 0) 2108 return (ENOSYS); 2109 2110 if (error = zfs_zaccess(zp, ACE_READ_ACL, 0, skipaclchk, cr)) 2111 return (error); 2112 2113 mutex_enter(&zp->z_acl_lock); 2114 2115 error = zfs_acl_node_read(zp, &aclp, B_FALSE); 2116 if (error != 0) { 2117 mutex_exit(&zp->z_acl_lock); 2118 return (error); 2119 } 2120 2121 /* 2122 * Scan ACL to determine number of ACEs 2123 */ 2124 if ((zp->z_pflags & ZFS_ACL_OBJ_ACE) && !(mask & VSA_ACE_ALLTYPES)) { 2125 void *zacep = NULL; 2126 uint64_t who; 2127 uint32_t access_mask; 2128 uint16_t type, iflags; 2129 2130 while (zacep = zfs_acl_next_ace(aclp, zacep, 2131 &who, &access_mask, &iflags, &type)) { 2132 switch (type) { 2133 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 2134 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 2135 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 2136 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 2137 largeace++; 2138 continue; 2139 default: 2140 count++; 2141 } 2142 } 2143 vsecp->vsa_aclcnt = count; 2144 } else 2145 count = (int)aclp->z_acl_count; 2146 2147 if (mask & VSA_ACECNT) { 2148 vsecp->vsa_aclcnt = count; 2149 } 2150 2151 if (mask & VSA_ACE) { 2152 size_t aclsz; 2153 2154 aclsz = count * sizeof (ace_t) + 2155 sizeof (ace_object_t) * largeace; 2156 2157 vsecp->vsa_aclentp = kmem_alloc(aclsz, KM_SLEEP); 2158 vsecp->vsa_aclentsz = aclsz; 2159 2160 if (aclp->z_version == ZFS_ACL_VERSION_FUID) 2161 zfs_copy_fuid_2_ace(zp->z_zfsvfs, aclp, cr, 2162 vsecp->vsa_aclentp, !(mask & VSA_ACE_ALLTYPES)); 2163 else { 2164 zfs_acl_node_t *aclnode; 2165 void *start = vsecp->vsa_aclentp; 2166 2167 for (aclnode = list_head(&aclp->z_acl); aclnode; 2168 aclnode = list_next(&aclp->z_acl, aclnode)) { 2169 bcopy(aclnode->z_acldata, start, 2170 aclnode->z_size); 2171 start = (caddr_t)start + aclnode->z_size; 2172 } 2173 ASSERT((caddr_t)start - (caddr_t)vsecp->vsa_aclentp == 2174 aclp->z_acl_bytes); 2175 } 2176 } 2177 if (mask & VSA_ACE_ACLFLAGS) { 2178 vsecp->vsa_aclflags = 0; 2179 if (zp->z_pflags & ZFS_ACL_DEFAULTED) 2180 vsecp->vsa_aclflags |= ACL_DEFAULTED; 2181 if (zp->z_pflags & ZFS_ACL_PROTECTED) 2182 vsecp->vsa_aclflags |= ACL_PROTECTED; 2183 if (zp->z_pflags & ZFS_ACL_AUTO_INHERIT) 2184 vsecp->vsa_aclflags |= ACL_AUTO_INHERIT; 2185 } 2186 2187 mutex_exit(&zp->z_acl_lock); 2188 2189 return (0); 2190 } 2191 2192 int 2193 zfs_vsec_2_aclp(zfsvfs_t *zfsvfs, vtype_t obj_type, 2194 vsecattr_t *vsecp, cred_t *cr, zfs_fuid_info_t **fuidp, zfs_acl_t **zaclp) 2195 { 2196 zfs_acl_t *aclp; 2197 zfs_acl_node_t *aclnode; 2198 int aclcnt = vsecp->vsa_aclcnt; 2199 int error; 2200 2201 if (vsecp->vsa_aclcnt > MAX_ACL_ENTRIES || vsecp->vsa_aclcnt <= 0) 2202 return (EINVAL); 2203 2204 aclp = zfs_acl_alloc(zfs_acl_version(zfsvfs->z_version)); 2205 2206 aclp->z_hints = 0; 2207 aclnode = zfs_acl_node_alloc(aclcnt * sizeof (zfs_object_ace_t)); 2208 if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) { 2209 if ((error = zfs_copy_ace_2_oldace(obj_type, aclp, 2210 (ace_t *)vsecp->vsa_aclentp, aclnode->z_acldata, 2211 aclcnt, &aclnode->z_size)) != 0) { 2212 zfs_acl_free(aclp); 2213 zfs_acl_node_free(aclnode); 2214 return (error); 2215 } 2216 } else { 2217 if ((error = zfs_copy_ace_2_fuid(zfsvfs, obj_type, aclp, 2218 vsecp->vsa_aclentp, aclnode->z_acldata, aclcnt, 2219 &aclnode->z_size, fuidp, cr)) != 0) { 2220 zfs_acl_free(aclp); 2221 zfs_acl_node_free(aclnode); 2222 return (error); 2223 } 2224 } 2225 aclp->z_acl_bytes = aclnode->z_size; 2226 aclnode->z_ace_count = aclcnt; 2227 aclp->z_acl_count = aclcnt; 2228 list_insert_head(&aclp->z_acl, aclnode); 2229 2230 /* 2231 * If flags are being set then add them to z_hints 2232 */ 2233 if (vsecp->vsa_mask & VSA_ACE_ACLFLAGS) { 2234 if (vsecp->vsa_aclflags & ACL_PROTECTED) 2235 aclp->z_hints |= ZFS_ACL_PROTECTED; 2236 if (vsecp->vsa_aclflags & ACL_DEFAULTED) 2237 aclp->z_hints |= ZFS_ACL_DEFAULTED; 2238 if (vsecp->vsa_aclflags & ACL_AUTO_INHERIT) 2239 aclp->z_hints |= ZFS_ACL_AUTO_INHERIT; 2240 } 2241 2242 *zaclp = aclp; 2243 2244 return (0); 2245 } 2246 2247 /* 2248 * Set a files ACL 2249 */ 2250 int 2251 zfs_setacl(znode_t *zp, vsecattr_t *vsecp, boolean_t skipaclchk, cred_t *cr) 2252 { 2253 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 2254 zilog_t *zilog = zfsvfs->z_log; 2255 ulong_t mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT); 2256 dmu_tx_t *tx; 2257 int error; 2258 zfs_acl_t *aclp; 2259 zfs_fuid_info_t *fuidp = NULL; 2260 boolean_t fuid_dirtied; 2261 2262 if (mask == 0) 2263 return (ENOSYS); 2264 2265 if (zp->z_pflags & ZFS_IMMUTABLE) 2266 return (EPERM); 2267 2268 if (error = zfs_zaccess(zp, ACE_WRITE_ACL, 0, skipaclchk, cr)) 2269 return (error); 2270 2271 error = zfs_vsec_2_aclp(zfsvfs, ZTOV(zp)->v_type, vsecp, cr, &fuidp, 2272 &aclp); 2273 if (error) 2274 return (error); 2275 2276 /* 2277 * If ACL wide flags aren't being set then preserve any 2278 * existing flags. 2279 */ 2280 if (!(vsecp->vsa_mask & VSA_ACE_ACLFLAGS)) { 2281 aclp->z_hints |= 2282 (zp->z_pflags & V4_ACL_WIDE_FLAGS); 2283 } 2284 top: 2285 mutex_enter(&zp->z_lock); 2286 mutex_enter(&zp->z_acl_lock); 2287 2288 tx = dmu_tx_create(zfsvfs->z_os); 2289 2290 dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_TRUE); 2291 2292 fuid_dirtied = zfsvfs->z_fuid_dirty; 2293 if (fuid_dirtied) 2294 zfs_fuid_txhold(zfsvfs, tx); 2295 2296 /* 2297 * If old version and ACL won't fit in bonus and we aren't 2298 * upgrading then take out necessary DMU holds 2299 */ 2300 2301 if (ZFS_EXTERNAL_ACL(zp)) { 2302 if (zfsvfs->z_version <= ZPL_VERSION_SA && 2303 ZNODE_ACL_VERSION(zp) <= ZFS_ACL_VERSION_INITIAL) { 2304 dmu_tx_hold_free(tx, ZFS_EXTERNAL_ACL(zp), 0, 2305 DMU_OBJECT_END); 2306 } else { 2307 dmu_tx_hold_write(tx, ZFS_EXTERNAL_ACL(zp), 2308 0, aclp->z_acl_bytes); 2309 } 2310 } else if (!zp->z_is_sa && aclp->z_acl_bytes > ZFS_ACE_SPACE) { 2311 dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0, aclp->z_acl_bytes); 2312 } 2313 2314 zfs_sa_upgrade_txholds(tx, zp); 2315 error = dmu_tx_assign(tx, TXG_NOWAIT); 2316 if (error) { 2317 mutex_exit(&zp->z_acl_lock); 2318 mutex_exit(&zp->z_lock); 2319 2320 if (error == ERESTART) { 2321 dmu_tx_wait(tx); 2322 dmu_tx_abort(tx); 2323 goto top; 2324 } 2325 dmu_tx_abort(tx); 2326 zfs_acl_free(aclp); 2327 return (error); 2328 } 2329 2330 error = zfs_aclset_common(zp, aclp, cr, tx); 2331 ASSERT(error == 0); 2332 zp->z_acl_cached = aclp; 2333 2334 if (fuid_dirtied) 2335 zfs_fuid_sync(zfsvfs, tx); 2336 2337 zfs_log_acl(zilog, tx, zp, vsecp, fuidp); 2338 2339 if (fuidp) 2340 zfs_fuid_info_free(fuidp); 2341 dmu_tx_commit(tx); 2342 done: 2343 mutex_exit(&zp->z_acl_lock); 2344 mutex_exit(&zp->z_lock); 2345 2346 return (error); 2347 } 2348 2349 /* 2350 * Check accesses of interest (AoI) against attributes of the dataset 2351 * such as read-only. Returns zero if no AoI conflict with dataset 2352 * attributes, otherwise an appropriate errno is returned. 2353 */ 2354 static int 2355 zfs_zaccess_dataset_check(znode_t *zp, uint32_t v4_mode) 2356 { 2357 if ((v4_mode & WRITE_MASK) && 2358 (zp->z_zfsvfs->z_vfs->vfs_flag & VFS_RDONLY) && 2359 (!IS_DEVVP(ZTOV(zp)) || 2360 (IS_DEVVP(ZTOV(zp)) && (v4_mode & WRITE_MASK_ATTRS)))) { 2361 return (EROFS); 2362 } 2363 2364 /* 2365 * Only check for READONLY on non-directories. 2366 */ 2367 if ((v4_mode & WRITE_MASK_DATA) && 2368 (((ZTOV(zp)->v_type != VDIR) && 2369 (zp->z_pflags & (ZFS_READONLY | ZFS_IMMUTABLE))) || 2370 (ZTOV(zp)->v_type == VDIR && 2371 (zp->z_pflags & ZFS_IMMUTABLE)))) { 2372 return (EPERM); 2373 } 2374 2375 if ((v4_mode & (ACE_DELETE | ACE_DELETE_CHILD)) && 2376 (zp->z_pflags & ZFS_NOUNLINK)) { 2377 return (EPERM); 2378 } 2379 2380 if (((v4_mode & (ACE_READ_DATA|ACE_EXECUTE)) && 2381 (zp->z_pflags & ZFS_AV_QUARANTINED))) { 2382 return (EACCES); 2383 } 2384 2385 return (0); 2386 } 2387 2388 /* 2389 * The primary usage of this function is to loop through all of the 2390 * ACEs in the znode, determining what accesses of interest (AoI) to 2391 * the caller are allowed or denied. The AoI are expressed as bits in 2392 * the working_mode parameter. As each ACE is processed, bits covered 2393 * by that ACE are removed from the working_mode. This removal 2394 * facilitates two things. The first is that when the working mode is 2395 * empty (= 0), we know we've looked at all the AoI. The second is 2396 * that the ACE interpretation rules don't allow a later ACE to undo 2397 * something granted or denied by an earlier ACE. Removing the 2398 * discovered access or denial enforces this rule. At the end of 2399 * processing the ACEs, all AoI that were found to be denied are 2400 * placed into the working_mode, giving the caller a mask of denied 2401 * accesses. Returns: 2402 * 0 if all AoI granted 2403 * EACCESS if the denied mask is non-zero 2404 * other error if abnormal failure (e.g., IO error) 2405 * 2406 * A secondary usage of the function is to determine if any of the 2407 * AoI are granted. If an ACE grants any access in 2408 * the working_mode, we immediately short circuit out of the function. 2409 * This mode is chosen by setting anyaccess to B_TRUE. The 2410 * working_mode is not a denied access mask upon exit if the function 2411 * is used in this manner. 2412 */ 2413 static int 2414 zfs_zaccess_aces_check(znode_t *zp, uint32_t *working_mode, 2415 boolean_t anyaccess, cred_t *cr) 2416 { 2417 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 2418 zfs_acl_t *aclp; 2419 int error; 2420 uid_t uid = crgetuid(cr); 2421 uint64_t who; 2422 uint16_t type, iflags; 2423 uint16_t entry_type; 2424 uint32_t access_mask; 2425 uint32_t deny_mask = 0; 2426 zfs_ace_hdr_t *acep = NULL; 2427 boolean_t checkit; 2428 uint64_t gowner; 2429 2430 mutex_enter(&zp->z_acl_lock); 2431 2432 error = zfs_acl_node_read(zp, &aclp, B_FALSE); 2433 if (error != 0) { 2434 mutex_exit(&zp->z_acl_lock); 2435 return (error); 2436 } 2437 2438 ASSERT(zp->z_acl_cached); 2439 2440 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_GID(zfsvfs), 2441 &gowner, sizeof (gowner))) != 0) 2442 return (error); 2443 2444 while (acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask, 2445 &iflags, &type)) { 2446 uint32_t mask_matched; 2447 2448 if (!zfs_acl_valid_ace_type(type, iflags)) 2449 continue; 2450 2451 if (ZTOV(zp)->v_type == VDIR && (iflags & ACE_INHERIT_ONLY_ACE)) 2452 continue; 2453 2454 /* Skip ACE if it does not affect any AoI */ 2455 mask_matched = (access_mask & *working_mode); 2456 if (!mask_matched) 2457 continue; 2458 2459 entry_type = (iflags & ACE_TYPE_FLAGS); 2460 2461 checkit = B_FALSE; 2462 2463 switch (entry_type) { 2464 case ACE_OWNER: 2465 if (uid == zp->z_uid) 2466 checkit = B_TRUE; 2467 break; 2468 case OWNING_GROUP: 2469 who = gowner; 2470 /*FALLTHROUGH*/ 2471 case ACE_IDENTIFIER_GROUP: 2472 checkit = zfs_groupmember(zfsvfs, who, cr); 2473 break; 2474 case ACE_EVERYONE: 2475 checkit = B_TRUE; 2476 break; 2477 2478 /* USER Entry */ 2479 default: 2480 if (entry_type == 0) { 2481 uid_t newid; 2482 2483 newid = zfs_fuid_map_id(zfsvfs, who, cr, 2484 ZFS_ACE_USER); 2485 if (newid != IDMAP_WK_CREATOR_OWNER_UID && 2486 uid == newid) 2487 checkit = B_TRUE; 2488 break; 2489 } else { 2490 mutex_exit(&zp->z_acl_lock); 2491 return (EIO); 2492 } 2493 } 2494 2495 if (checkit) { 2496 if (type == DENY) { 2497 DTRACE_PROBE3(zfs__ace__denies, 2498 znode_t *, zp, 2499 zfs_ace_hdr_t *, acep, 2500 uint32_t, mask_matched); 2501 deny_mask |= mask_matched; 2502 } else { 2503 DTRACE_PROBE3(zfs__ace__allows, 2504 znode_t *, zp, 2505 zfs_ace_hdr_t *, acep, 2506 uint32_t, mask_matched); 2507 if (anyaccess) { 2508 mutex_exit(&zp->z_acl_lock); 2509 return (0); 2510 } 2511 } 2512 *working_mode &= ~mask_matched; 2513 } 2514 2515 /* Are we done? */ 2516 if (*working_mode == 0) 2517 break; 2518 } 2519 2520 mutex_exit(&zp->z_acl_lock); 2521 2522 /* Put the found 'denies' back on the working mode */ 2523 if (deny_mask) { 2524 *working_mode |= deny_mask; 2525 return (EACCES); 2526 } else if (*working_mode) { 2527 return (-1); 2528 } 2529 2530 return (0); 2531 } 2532 2533 /* 2534 * Return true if any access whatsoever granted, we don't actually 2535 * care what access is granted. 2536 */ 2537 boolean_t 2538 zfs_has_access(znode_t *zp, cred_t *cr) 2539 { 2540 uint32_t have = ACE_ALL_PERMS; 2541 2542 if (zfs_zaccess_aces_check(zp, &have, B_TRUE, cr) != 0) { 2543 return ( 2544 secpolicy_vnode_access(cr, ZTOV(zp), 2545 zp->z_uid, VREAD) == 0 || secpolicy_vnode_access(cr, 2546 ZTOV(zp), zp->z_uid, VWRITE) == 0 || 2547 secpolicy_vnode_access(cr, ZTOV(zp), 2548 zp->z_uid, VEXEC) == 0 || 2549 secpolicy_vnode_chown(cr, zp->z_uid) == 0 || 2550 secpolicy_vnode_setdac(cr, zp->z_uid) == 0 || 2551 secpolicy_vnode_remove(cr) == 0); 2552 } 2553 return (B_TRUE); 2554 } 2555 2556 static int 2557 zfs_zaccess_common(znode_t *zp, uint32_t v4_mode, uint32_t *working_mode, 2558 boolean_t *check_privs, boolean_t skipaclchk, cred_t *cr) 2559 { 2560 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 2561 int err; 2562 2563 *working_mode = v4_mode; 2564 *check_privs = B_TRUE; 2565 2566 /* 2567 * Short circuit empty requests 2568 */ 2569 if (v4_mode == 0 || zfsvfs->z_replay) { 2570 *working_mode = 0; 2571 return (0); 2572 } 2573 2574 if ((err = zfs_zaccess_dataset_check(zp, v4_mode)) != 0) { 2575 *check_privs = B_FALSE; 2576 return (err); 2577 } 2578 2579 /* 2580 * The caller requested that the ACL check be skipped. This 2581 * would only happen if the caller checked VOP_ACCESS() with a 2582 * 32 bit ACE mask and already had the appropriate permissions. 2583 */ 2584 if (skipaclchk) { 2585 *working_mode = 0; 2586 return (0); 2587 } 2588 2589 return (zfs_zaccess_aces_check(zp, working_mode, B_FALSE, cr)); 2590 } 2591 2592 static int 2593 zfs_zaccess_append(znode_t *zp, uint32_t *working_mode, boolean_t *check_privs, 2594 cred_t *cr) 2595 { 2596 if (*working_mode != ACE_WRITE_DATA) 2597 return (EACCES); 2598 2599 return (zfs_zaccess_common(zp, ACE_APPEND_DATA, working_mode, 2600 check_privs, B_FALSE, cr)); 2601 } 2602 2603 int 2604 zfs_fastaccesschk_execute(znode_t *zdp, cred_t *cr) 2605 { 2606 boolean_t owner = B_FALSE; 2607 boolean_t groupmbr = B_FALSE; 2608 boolean_t is_attr; 2609 uid_t uid = crgetuid(cr); 2610 int error; 2611 2612 if (zdp->z_pflags & ZFS_AV_QUARANTINED) 2613 return (EACCES); 2614 2615 is_attr = ((zdp->z_pflags & ZFS_XATTR) && 2616 (ZTOV(zdp)->v_type == VDIR)); 2617 if (is_attr) 2618 goto slow; 2619 2620 2621 mutex_enter(&zdp->z_acl_lock); 2622 2623 if (zdp->z_pflags & ZFS_NO_EXECS_DENIED) { 2624 mutex_exit(&zdp->z_acl_lock); 2625 return (0); 2626 } 2627 2628 if (IS_EPHEMERAL(zdp->z_uid) != 0 || IS_EPHEMERAL(zdp->z_gid) != 0) { 2629 mutex_exit(&zdp->z_acl_lock); 2630 goto slow; 2631 } 2632 2633 if (uid == zdp->z_uid) { 2634 owner = B_TRUE; 2635 if (zdp->z_mode & S_IXUSR) { 2636 mutex_exit(&zdp->z_acl_lock); 2637 return (0); 2638 } else { 2639 mutex_exit(&zdp->z_acl_lock); 2640 goto slow; 2641 } 2642 } 2643 if (groupmember(zdp->z_gid, cr)) { 2644 groupmbr = B_TRUE; 2645 if (zdp->z_mode & S_IXGRP) { 2646 mutex_exit(&zdp->z_acl_lock); 2647 return (0); 2648 } else { 2649 mutex_exit(&zdp->z_acl_lock); 2650 goto slow; 2651 } 2652 } 2653 if (!owner && !groupmbr) { 2654 if (zdp->z_mode & S_IXOTH) { 2655 mutex_exit(&zdp->z_acl_lock); 2656 return (0); 2657 } 2658 } 2659 2660 mutex_exit(&zdp->z_acl_lock); 2661 2662 slow: 2663 DTRACE_PROBE(zfs__fastpath__execute__access__miss); 2664 ZFS_ENTER(zdp->z_zfsvfs); 2665 error = zfs_zaccess(zdp, ACE_EXECUTE, 0, B_FALSE, cr); 2666 ZFS_EXIT(zdp->z_zfsvfs); 2667 return (error); 2668 } 2669 2670 /* 2671 * Determine whether Access should be granted/denied, invoking least 2672 * priv subsytem when a deny is determined. 2673 */ 2674 int 2675 zfs_zaccess(znode_t *zp, int mode, int flags, boolean_t skipaclchk, cred_t *cr) 2676 { 2677 uint32_t working_mode; 2678 int error; 2679 int is_attr; 2680 boolean_t check_privs; 2681 znode_t *xzp; 2682 znode_t *check_zp = zp; 2683 2684 is_attr = ((zp->z_pflags & ZFS_XATTR) && (ZTOV(zp)->v_type == VDIR)); 2685 2686 /* 2687 * If attribute then validate against base file 2688 */ 2689 if (is_attr) { 2690 uint64_t parent; 2691 2692 if ((error = sa_lookup(zp->z_sa_hdl, 2693 SA_ZPL_PARENT(zp->z_zfsvfs), &parent, 2694 sizeof (parent))) != 0) 2695 return (error); 2696 2697 if ((error = zfs_zget(zp->z_zfsvfs, 2698 parent, &xzp)) != 0) { 2699 return (error); 2700 } 2701 2702 check_zp = xzp; 2703 2704 /* 2705 * fixup mode to map to xattr perms 2706 */ 2707 2708 if (mode & (ACE_WRITE_DATA|ACE_APPEND_DATA)) { 2709 mode &= ~(ACE_WRITE_DATA|ACE_APPEND_DATA); 2710 mode |= ACE_WRITE_NAMED_ATTRS; 2711 } 2712 2713 if (mode & (ACE_READ_DATA|ACE_EXECUTE)) { 2714 mode &= ~(ACE_READ_DATA|ACE_EXECUTE); 2715 mode |= ACE_READ_NAMED_ATTRS; 2716 } 2717 } 2718 2719 if ((error = zfs_zaccess_common(check_zp, mode, &working_mode, 2720 &check_privs, skipaclchk, cr)) == 0) { 2721 if (is_attr) 2722 VN_RELE(ZTOV(xzp)); 2723 return (0); 2724 } 2725 2726 if (error && !check_privs) { 2727 if (is_attr) 2728 VN_RELE(ZTOV(xzp)); 2729 return (error); 2730 } 2731 2732 if (error && (flags & V_APPEND)) { 2733 error = zfs_zaccess_append(zp, &working_mode, &check_privs, cr); 2734 } 2735 2736 if (error && check_privs) { 2737 mode_t checkmode = 0; 2738 2739 /* 2740 * First check for implicit owner permission on 2741 * read_acl/read_attributes 2742 */ 2743 2744 error = 0; 2745 ASSERT(working_mode != 0); 2746 2747 if ((working_mode & (ACE_READ_ACL|ACE_READ_ATTRIBUTES) && 2748 zp->z_uid == crgetuid(cr))) 2749 working_mode &= ~(ACE_READ_ACL|ACE_READ_ATTRIBUTES); 2750 2751 if (working_mode & (ACE_READ_DATA|ACE_READ_NAMED_ATTRS| 2752 ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_SYNCHRONIZE)) 2753 checkmode |= VREAD; 2754 if (working_mode & (ACE_WRITE_DATA|ACE_WRITE_NAMED_ATTRS| 2755 ACE_APPEND_DATA|ACE_WRITE_ATTRIBUTES|ACE_SYNCHRONIZE)) 2756 checkmode |= VWRITE; 2757 if (working_mode & ACE_EXECUTE) 2758 checkmode |= VEXEC; 2759 2760 if (checkmode) 2761 error = secpolicy_vnode_access(cr, ZTOV(check_zp), 2762 zp->z_uid, checkmode); 2763 2764 if (error == 0 && (working_mode & ACE_WRITE_OWNER)) 2765 error = secpolicy_vnode_chown(cr, zp->z_uid); 2766 if (error == 0 && (working_mode & ACE_WRITE_ACL)) 2767 error = secpolicy_vnode_setdac(cr, zp->z_uid); 2768 2769 if (error == 0 && (working_mode & 2770 (ACE_DELETE|ACE_DELETE_CHILD))) 2771 error = secpolicy_vnode_remove(cr); 2772 2773 if (error == 0 && (working_mode & ACE_SYNCHRONIZE)) { 2774 error = secpolicy_vnode_chown(cr, zp->z_uid); 2775 } 2776 if (error == 0) { 2777 /* 2778 * See if any bits other than those already checked 2779 * for are still present. If so then return EACCES 2780 */ 2781 if (working_mode & ~(ZFS_CHECKED_MASKS)) { 2782 error = EACCES; 2783 } 2784 } 2785 } 2786 2787 if (is_attr) 2788 VN_RELE(ZTOV(xzp)); 2789 2790 return (error); 2791 } 2792 2793 /* 2794 * Translate traditional unix VREAD/VWRITE/VEXEC mode into 2795 * native ACL format and call zfs_zaccess() 2796 */ 2797 int 2798 zfs_zaccess_rwx(znode_t *zp, mode_t mode, int flags, cred_t *cr) 2799 { 2800 return (zfs_zaccess(zp, zfs_unix_to_v4(mode >> 6), flags, B_FALSE, cr)); 2801 } 2802 2803 /* 2804 * Access function for secpolicy_vnode_setattr 2805 */ 2806 int 2807 zfs_zaccess_unix(znode_t *zp, mode_t mode, cred_t *cr) 2808 { 2809 int v4_mode = zfs_unix_to_v4(mode >> 6); 2810 2811 return (zfs_zaccess(zp, v4_mode, 0, B_FALSE, cr)); 2812 } 2813 2814 static int 2815 zfs_delete_final_check(znode_t *zp, znode_t *dzp, 2816 mode_t missing_perms, cred_t *cr) 2817 { 2818 int error; 2819 2820 error = secpolicy_vnode_access(cr, ZTOV(dzp), 2821 dzp->z_uid, missing_perms); 2822 2823 if (error == 0) 2824 error = zfs_sticky_remove_access(dzp, zp, cr); 2825 2826 return (error); 2827 } 2828 2829 /* 2830 * Determine whether Access should be granted/deny, without 2831 * consulting least priv subsystem. 2832 * 2833 * 2834 * The following chart is the recommended NFSv4 enforcement for 2835 * ability to delete an object. 2836 * 2837 * ------------------------------------------------------- 2838 * | Parent Dir | Target Object Permissions | 2839 * | permissions | | 2840 * ------------------------------------------------------- 2841 * | | ACL Allows | ACL Denies| Delete | 2842 * | | Delete | Delete | unspecified| 2843 * ------------------------------------------------------- 2844 * | ACL Allows | Permit | Permit | Permit | 2845 * | DELETE_CHILD | | 2846 * ------------------------------------------------------- 2847 * | ACL Denies | Permit | Deny | Deny | 2848 * | DELETE_CHILD | | | | 2849 * ------------------------------------------------------- 2850 * | ACL specifies | | | | 2851 * | only allow | Permit | Permit | Permit | 2852 * | write and | | | | 2853 * | execute | | | | 2854 * ------------------------------------------------------- 2855 * | ACL denies | | | | 2856 * | write and | Permit | Deny | Deny | 2857 * | execute | | | | 2858 * ------------------------------------------------------- 2859 * ^ 2860 * | 2861 * No search privilege, can't even look up file? 2862 * 2863 */ 2864 int 2865 zfs_zaccess_delete(znode_t *dzp, znode_t *zp, cred_t *cr) 2866 { 2867 uint32_t dzp_working_mode = 0; 2868 uint32_t zp_working_mode = 0; 2869 int dzp_error, zp_error; 2870 mode_t missing_perms; 2871 boolean_t dzpcheck_privs = B_TRUE; 2872 boolean_t zpcheck_privs = B_TRUE; 2873 2874 /* 2875 * We want specific DELETE permissions to 2876 * take precedence over WRITE/EXECUTE. We don't 2877 * want an ACL such as this to mess us up. 2878 * user:joe:write_data:deny,user:joe:delete:allow 2879 * 2880 * However, deny permissions may ultimately be overridden 2881 * by secpolicy_vnode_access(). 2882 * 2883 * We will ask for all of the necessary permissions and then 2884 * look at the working modes from the directory and target object 2885 * to determine what was found. 2886 */ 2887 2888 if (zp->z_pflags & (ZFS_IMMUTABLE | ZFS_NOUNLINK)) 2889 return (EPERM); 2890 2891 /* 2892 * First row 2893 * If the directory permissions allow the delete, we are done. 2894 */ 2895 if ((dzp_error = zfs_zaccess_common(dzp, ACE_DELETE_CHILD, 2896 &dzp_working_mode, &dzpcheck_privs, B_FALSE, cr)) == 0) 2897 return (0); 2898 2899 /* 2900 * If target object has delete permission then we are done 2901 */ 2902 if ((zp_error = zfs_zaccess_common(zp, ACE_DELETE, &zp_working_mode, 2903 &zpcheck_privs, B_FALSE, cr)) == 0) 2904 return (0); 2905 2906 ASSERT(dzp_error && zp_error); 2907 2908 if (!dzpcheck_privs) 2909 return (dzp_error); 2910 if (!zpcheck_privs) 2911 return (zp_error); 2912 2913 /* 2914 * Second row 2915 * 2916 * If directory returns EACCES then delete_child was denied 2917 * due to deny delete_child. In this case send the request through 2918 * secpolicy_vnode_remove(). We don't use zfs_delete_final_check() 2919 * since that *could* allow the delete based on write/execute permission 2920 * and we want delete permissions to override write/execute. 2921 */ 2922 2923 if (dzp_error == EACCES) 2924 return (secpolicy_vnode_remove(cr)); 2925 2926 /* 2927 * Third Row 2928 * only need to see if we have write/execute on directory. 2929 */ 2930 2931 if ((dzp_error = zfs_zaccess_common(dzp, ACE_EXECUTE|ACE_WRITE_DATA, 2932 &dzp_working_mode, &dzpcheck_privs, B_FALSE, cr)) == 0) 2933 return (zfs_sticky_remove_access(dzp, zp, cr)); 2934 2935 if (!dzpcheck_privs) 2936 return (dzp_error); 2937 2938 /* 2939 * Fourth row 2940 */ 2941 2942 missing_perms = (dzp_working_mode & ACE_WRITE_DATA) ? VWRITE : 0; 2943 missing_perms |= (dzp_working_mode & ACE_EXECUTE) ? VEXEC : 0; 2944 2945 ASSERT(missing_perms); 2946 2947 return (zfs_delete_final_check(zp, dzp, missing_perms, cr)); 2948 2949 } 2950 2951 int 2952 zfs_zaccess_rename(znode_t *sdzp, znode_t *szp, znode_t *tdzp, 2953 znode_t *tzp, cred_t *cr) 2954 { 2955 int add_perm; 2956 int error; 2957 2958 if (szp->z_pflags & ZFS_AV_QUARANTINED) 2959 return (EACCES); 2960 2961 add_perm = (ZTOV(szp)->v_type == VDIR) ? 2962 ACE_ADD_SUBDIRECTORY : ACE_ADD_FILE; 2963 2964 /* 2965 * Rename permissions are combination of delete permission + 2966 * add file/subdir permission. 2967 */ 2968 2969 /* 2970 * first make sure we do the delete portion. 2971 * 2972 * If that succeeds then check for add_file/add_subdir permissions 2973 */ 2974 2975 if (error = zfs_zaccess_delete(sdzp, szp, cr)) 2976 return (error); 2977 2978 /* 2979 * If we have a tzp, see if we can delete it? 2980 */ 2981 if (tzp) { 2982 if (error = zfs_zaccess_delete(tdzp, tzp, cr)) 2983 return (error); 2984 } 2985 2986 /* 2987 * Now check for add permissions 2988 */ 2989 error = zfs_zaccess(tdzp, add_perm, 0, B_FALSE, cr); 2990 2991 return (error); 2992 } 2993