xref: /titanic_50/usr/src/uts/common/fs/zfs/zfs_acl.c (revision fa9e4066f08beec538e775443c5be79dd423fcab)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 /*
23  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 #include <sys/types.h>
30 #include <sys/param.h>
31 #include <sys/time.h>
32 #include <sys/systm.h>
33 #include <sys/sysmacros.h>
34 #include <sys/resource.h>
35 #include <sys/vfs.h>
36 #include <sys/vnode.h>
37 #include <sys/file.h>
38 #include <sys/stat.h>
39 #include <sys/kmem.h>
40 #include <sys/cmn_err.h>
41 #include <sys/errno.h>
42 #include <sys/unistd.h>
43 #include <sys/fs/zfs.h>
44 #include <sys/mode.h>
45 #include <sys/policy.h>
46 #include <sys/zfs_znode.h>
47 #include <sys/zfs_acl.h>
48 #include <sys/zfs_dir.h>
49 #include <sys/zfs_vfsops.h>
50 #include <sys/dmu.h>
51 #include <sys/zap.h>
52 #include <util/qsort.h>
53 #include "fs/fs_subr.h"
54 #include <acl/acl_common.h>
55 
56 #define	ALLOW	ACE_ACCESS_ALLOWED_ACE_TYPE
57 #define	DENY	ACE_ACCESS_DENIED_ACE_TYPE
58 
59 #define	OWNING_GROUP		(ACE_GROUP|ACE_IDENTIFIER_GROUP)
60 #define	EVERYONE_ALLOW_MASK (ACE_READ_ACL|ACE_READ_ATTRIBUTES | \
61     ACE_READ_NAMED_ATTRS|ACE_SYNCHRONIZE)
62 #define	EVERYONE_DENY_MASK (ACE_WRITE_ACL|ACE_WRITE_OWNER | \
63     ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS)
64 #define	OWNER_ALLOW_MASK (ACE_WRITE_ACL | ACE_WRITE_OWNER | \
65     ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS)
66 #define	WRITE_MASK (ACE_WRITE_DATA|ACE_APPEND_DATA|ACE_WRITE_NAMED_ATTRS| \
67     ACE_WRITE_ATTRIBUTES|ACE_WRITE_ACL|ACE_WRITE_OWNER)
68 
69 #define	OGE_CLEAR	(ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \
70     ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE)
71 
72 #define	OKAY_MASK_BITS (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \
73     ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE)
74 
75 #define	ALL_INHERIT	(ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE | \
76     ACE_NO_PROPAGATE_INHERIT_ACE|ACE_INHERIT_ONLY_ACE)
77 
78 #define	SECURE_NO_INHERIT	(ACE_WRITE_ACL|ACE_WRITE_OWNER)
79 
80 #define	OGE_PAD	6		/* traditional owner/group/everyone ACES */
81 
82 static int zfs_ace_can_use(znode_t *zp, ace_t *);
83 
84 static zfs_acl_t *
85 zfs_acl_alloc(int slots)
86 {
87 	zfs_acl_t *aclp;
88 
89 	aclp = kmem_zalloc(sizeof (zfs_acl_t), KM_SLEEP);
90 	if (slots != 0) {
91 		aclp->z_acl = kmem_alloc(ZFS_ACL_SIZE(slots), KM_SLEEP);
92 		aclp->z_acl_count = 0;
93 		aclp->z_state = ACL_DATA_ALLOCED;
94 	} else {
95 		aclp->z_state = 0;
96 	}
97 	aclp->z_slots = slots;
98 	return (aclp);
99 }
100 
101 void
102 zfs_acl_free(zfs_acl_t *aclp)
103 {
104 	if (aclp->z_state == ACL_DATA_ALLOCED) {
105 		kmem_free(aclp->z_acl, ZFS_ACL_SIZE(aclp->z_slots));
106 	}
107 	kmem_free(aclp, sizeof (zfs_acl_t));
108 }
109 
110 static uint32_t
111 zfs_v4_to_unix(uint32_t access_mask)
112 {
113 	uint32_t new_mask = 0;
114 
115 	if (access_mask & (ACE_READ_DATA | ACE_LIST_DIRECTORY))
116 		new_mask |= S_IROTH;
117 	if (access_mask & (ACE_WRITE_DATA|ACE_APPEND_DATA|ACE_ADD_FILE))
118 		new_mask |= S_IWOTH;
119 	if (access_mask & (ACE_EXECUTE|ACE_READ_NAMED_ATTRS))
120 		new_mask |= S_IXOTH;
121 
122 	return (new_mask);
123 }
124 
125 /*
126  * Convert unix access mask to v4 access mask
127  */
128 static uint32_t
129 zfs_unix_to_v4(uint32_t access_mask)
130 {
131 	uint32_t new_mask = 0;
132 
133 	if (access_mask & 01)
134 		new_mask |= (ACE_EXECUTE);
135 	if (access_mask & 02) {
136 		new_mask |= (ACE_WRITE_DATA);
137 	} if (access_mask & 04) {
138 		new_mask |= ACE_READ_DATA;
139 	}
140 	return (new_mask);
141 }
142 
143 static void
144 zfs_set_ace(ace_t *zacep, uint32_t access_mask, int access_type,
145     uid_t uid, int entry_type)
146 {
147 	zacep->a_access_mask = access_mask;
148 	zacep->a_type = access_type;
149 	zacep->a_who = uid;
150 	zacep->a_flags = entry_type;
151 }
152 
153 static uint64_t
154 zfs_mode_compute(znode_t *zp, zfs_acl_t *aclp)
155 {
156 	int 	i;
157 	int	entry_type;
158 	mode_t	mode = (zp->z_phys->zp_mode &
159 	    (S_IFMT | S_ISUID | S_ISGID | S_ISVTX));
160 	mode_t	 seen = 0;
161 	ace_t 	*acep;
162 
163 	for (i = 0, acep = aclp->z_acl;
164 	    i != aclp->z_acl_count; i++, acep++) {
165 		entry_type = (acep->a_flags & 0xf040);
166 		if (entry_type == ACE_OWNER) {
167 			if ((acep->a_access_mask & ACE_READ_DATA) &&
168 			    (!(seen & S_IRUSR))) {
169 				seen |= S_IRUSR;
170 				if (acep->a_type == ALLOW) {
171 					mode |= S_IRUSR;
172 				}
173 			}
174 			if ((acep->a_access_mask & ACE_WRITE_DATA) &&
175 			    (!(seen & S_IWUSR))) {
176 				seen |= S_IWUSR;
177 				if (acep->a_type == ALLOW) {
178 					mode |= S_IWUSR;
179 				}
180 			}
181 			if ((acep->a_access_mask & ACE_EXECUTE) &&
182 			    (!(seen & S_IXUSR))) {
183 				seen |= S_IXUSR;
184 				if (acep->a_type == ALLOW) {
185 					mode |= S_IXUSR;
186 				}
187 			}
188 		} else if (entry_type == OWNING_GROUP) {
189 			if ((acep->a_access_mask & ACE_READ_DATA) &&
190 			    (!(seen & S_IRGRP))) {
191 				seen |= S_IRGRP;
192 				if (acep->a_type == ALLOW) {
193 					mode |= S_IRGRP;
194 				}
195 			}
196 			if ((acep->a_access_mask & ACE_WRITE_DATA) &&
197 			    (!(seen & S_IWGRP))) {
198 				seen |= S_IWGRP;
199 				if (acep->a_type == ALLOW) {
200 					mode |= S_IWGRP;
201 				}
202 			}
203 			if ((acep->a_access_mask & ACE_EXECUTE) &&
204 			    (!(seen & S_IXGRP))) {
205 				seen |= S_IXGRP;
206 				if (acep->a_type == ALLOW) {
207 					mode |= S_IXGRP;
208 				}
209 			}
210 		} else if (entry_type == ACE_EVERYONE) {
211 			if ((acep->a_access_mask & ACE_READ_DATA)) {
212 				if (!(seen & S_IRUSR)) {
213 					seen |= S_IRUSR;
214 					if (acep->a_type == ALLOW) {
215 						mode |= S_IRUSR;
216 					}
217 				}
218 				if (!(seen & S_IRGRP)) {
219 					seen |= S_IRGRP;
220 					if (acep->a_type == ALLOW) {
221 						mode |= S_IRGRP;
222 					}
223 				}
224 				if (!(seen & S_IROTH)) {
225 					seen |= S_IROTH;
226 					if (acep->a_type == ALLOW) {
227 						mode |= S_IROTH;
228 					}
229 				}
230 			}
231 			if ((acep->a_access_mask & ACE_WRITE_DATA)) {
232 				if (!(seen & S_IWUSR)) {
233 					seen |= S_IWUSR;
234 					if (acep->a_type == ALLOW) {
235 						mode |= S_IWUSR;
236 					}
237 				}
238 				if (!(seen & S_IWGRP)) {
239 					seen |= S_IWGRP;
240 					if (acep->a_type == ALLOW) {
241 						mode |= S_IWGRP;
242 					}
243 				}
244 				if (!(seen & S_IWOTH)) {
245 					seen |= S_IWOTH;
246 					if (acep->a_type == ALLOW) {
247 						mode |= S_IWOTH;
248 					}
249 				}
250 			}
251 			if ((acep->a_access_mask & ACE_EXECUTE)) {
252 				if (!(seen & S_IXUSR)) {
253 					seen |= S_IXUSR;
254 					if (acep->a_type == ALLOW) {
255 						mode |= S_IXUSR;
256 					}
257 				}
258 				if (!(seen & S_IXGRP)) {
259 					seen |= S_IXGRP;
260 					if (acep->a_type == ALLOW) {
261 						mode |= S_IXGRP;
262 					}
263 				}
264 				if (!(seen & S_IXOTH)) {
265 					seen |= S_IXOTH;
266 					if (acep->a_type == ALLOW) {
267 						mode |= S_IXOTH;
268 					}
269 				}
270 			}
271 		}
272 	}
273 	return (mode);
274 }
275 
276 static zfs_acl_t *
277 zfs_acl_node_read_internal(znode_t *zp)
278 {
279 	zfs_acl_t	*aclp;
280 
281 	aclp = zfs_acl_alloc(0);
282 	aclp->z_acl_count = zp->z_phys->zp_acl.z_acl_count;
283 	aclp->z_acl = &zp->z_phys->zp_acl.z_ace_data[0];
284 
285 	return (aclp);
286 }
287 
288 /*
289  * Read an external acl object.
290  */
291 zfs_acl_t *
292 zfs_acl_node_read(znode_t *zp)
293 {
294 	uint64_t extacl = zp->z_phys->zp_acl.z_acl_extern_obj;
295 	zfs_acl_t	*aclp;
296 
297 	ASSERT(MUTEX_HELD(&zp->z_acl_lock));
298 
299 	if (zp->z_phys->zp_acl.z_acl_extern_obj == 0)
300 		return (zfs_acl_node_read_internal(zp));
301 
302 	aclp = zfs_acl_alloc(zp->z_phys->zp_acl.z_acl_count);
303 
304 	dmu_read(zp->z_zfsvfs->z_os, extacl, 0,
305 	    ZFS_ACL_SIZE(zp->z_phys->zp_acl.z_acl_count), aclp->z_acl);
306 
307 	aclp->z_acl_count = zp->z_phys->zp_acl.z_acl_count;
308 
309 	return (aclp);
310 }
311 
312 static boolean_t
313 zfs_acl_valid(znode_t *zp, ace_t *uace, int aclcnt, int *inherit)
314 {
315 	ace_t 	*acep;
316 	int i;
317 
318 	*inherit = 0;
319 
320 	if (aclcnt > MAX_ACL_ENTRIES || aclcnt <= 0) {
321 		return (B_FALSE);
322 	}
323 
324 	for (i = 0, acep = uace; i != aclcnt; i++, acep++) {
325 
326 		/*
327 		 * first check type of entry
328 		 */
329 
330 		switch (acep->a_flags & 0xf040) {
331 		case ACE_OWNER:
332 			acep->a_who = -1;
333 			break;
334 		case (ACE_IDENTIFIER_GROUP | ACE_GROUP):
335 		case ACE_IDENTIFIER_GROUP:
336 			if (acep->a_flags & ACE_GROUP) {
337 				acep->a_who = -1;
338 			}
339 			break;
340 		case ACE_EVERYONE:
341 			acep->a_who = -1;
342 			break;
343 		}
344 
345 		/*
346 		 * next check inheritance level flags
347 		 */
348 
349 		if (acep->a_type != ALLOW && acep->a_type != DENY)
350 			return (B_FALSE);
351 
352 		/*
353 		 * Only directories should have inheritance flags.
354 		 */
355 		if (ZTOV(zp)->v_type != VDIR && (acep->a_flags &
356 		    (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE|
357 		    ACE_INHERIT_ONLY_ACE|ACE_NO_PROPAGATE_INHERIT_ACE))) {
358 			return (B_FALSE);
359 		}
360 
361 		if (acep->a_flags &
362 		    (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE))
363 			*inherit = 1;
364 
365 		if (acep->a_flags &
366 		    (ACE_INHERIT_ONLY_ACE|ACE_NO_PROPAGATE_INHERIT_ACE)) {
367 			if ((acep->a_flags & (ACE_FILE_INHERIT_ACE|
368 			    ACE_DIRECTORY_INHERIT_ACE)) == 0) {
369 				return (B_FALSE);
370 			}
371 		}
372 	}
373 
374 	return (B_TRUE);
375 }
376 /*
377  * common code for setting acl's.
378  *
379  * This function is called from zfs_mode_update, zfs_perm_init, and zfs_setacl.
380  * zfs_setacl passes a non-NULL inherit pointer (ihp) to indicate that it's
381  * already checked the acl and knows whether to inherit.
382  */
383 int
384 zfs_aclset_common(znode_t *zp, zfs_acl_t *aclp, dmu_tx_t *tx, int *ihp)
385 {
386 	int 		inherit = 0;
387 	int		error;
388 	znode_phys_t	*zphys = zp->z_phys;
389 	zfs_znode_acl_t	*zacl = &zphys->zp_acl;
390 	uint32_t	acl_phys_size = ZFS_ACL_SIZE(aclp->z_acl_count);
391 	zfsvfs_t	*zfsvfs = zp->z_zfsvfs;
392 	uint64_t	aoid = zphys->zp_acl.z_acl_extern_obj;
393 
394 	ASSERT(MUTEX_HELD(&zp->z_lock));
395 	ASSERT(MUTEX_HELD(&zp->z_acl_lock));
396 
397 	if (ihp)
398 		inherit = *ihp;		/* already determined by caller */
399 	else if (!zfs_acl_valid(zp, aclp->z_acl,
400 	    aclp->z_acl_count, &inherit)) {
401 		return (EINVAL);
402 	}
403 
404 	dmu_buf_will_dirty(zp->z_dbuf, tx);
405 
406 	/*
407 	 * Will ACL fit internally?
408 	 */
409 	if (aclp->z_acl_count > ACE_SLOT_CNT) {
410 		if (aoid == 0) {
411 			aoid = dmu_object_alloc(zfsvfs->z_os,
412 			    DMU_OT_ACL, acl_phys_size, DMU_OT_NONE, 0, tx);
413 		} else {
414 			(void) dmu_object_set_blocksize(zfsvfs->z_os, aoid,
415 			    acl_phys_size, 0, tx);
416 		}
417 		zphys->zp_acl.z_acl_extern_obj = aoid;
418 		zphys->zp_acl.z_acl_count = aclp->z_acl_count;
419 		dmu_write(zfsvfs->z_os, aoid, 0,
420 		    acl_phys_size, aclp->z_acl, tx);
421 	} else {
422 		/*
423 		 * Migrating back embedded?
424 		 */
425 		if (zphys->zp_acl.z_acl_extern_obj) {
426 			error = dmu_object_free(zfsvfs->z_os,
427 				zp->z_phys->zp_acl.z_acl_extern_obj, tx);
428 			if (error)
429 				return (error);
430 			zphys->zp_acl.z_acl_extern_obj = 0;
431 		}
432 		bcopy(aclp->z_acl, zacl->z_ace_data,
433 		    aclp->z_acl_count * sizeof (ace_t));
434 		zacl->z_acl_count = aclp->z_acl_count;
435 	}
436 	if (inherit)
437 		zp->z_phys->zp_flags |= ZFS_INHERIT_ACE;
438 	else
439 		zp->z_phys->zp_flags &= ~ZFS_INHERIT_ACE;
440 
441 	zphys->zp_mode = zfs_mode_compute(zp, aclp);
442 	zfs_time_stamper_locked(zp, STATE_CHANGED, tx);
443 
444 	return (0);
445 }
446 
447 /*
448  * Create space for slots_needed ACEs to be append
449  * to aclp.
450  */
451 static void
452 zfs_acl_append(zfs_acl_t *aclp, int slots_needed)
453 {
454 	ace_t	*newacep;
455 	ace_t	*oldaclp;
456 	int	slot_cnt;
457 	int 	slots_left = aclp->z_slots - aclp->z_acl_count;
458 
459 	if (aclp->z_state == ACL_DATA_ALLOCED)
460 		ASSERT(aclp->z_slots >= aclp->z_acl_count);
461 	if (slots_left < slots_needed || aclp->z_state != ACL_DATA_ALLOCED) {
462 		slot_cnt = aclp->z_slots +  1 + (slots_needed - slots_left);
463 		newacep = kmem_alloc(ZFS_ACL_SIZE(slot_cnt), KM_SLEEP);
464 		bcopy(aclp->z_acl, newacep,
465 		    ZFS_ACL_SIZE(aclp->z_acl_count));
466 		oldaclp = aclp->z_acl;
467 		if (aclp->z_state == ACL_DATA_ALLOCED)
468 			kmem_free(oldaclp, ZFS_ACL_SIZE(aclp->z_slots));
469 		aclp->z_acl = newacep;
470 		aclp->z_slots = slot_cnt;
471 		aclp->z_state = ACL_DATA_ALLOCED;
472 	}
473 }
474 
475 /*
476  * Remove "slot" ACE from aclp
477  */
478 static void
479 zfs_ace_remove(zfs_acl_t *aclp, int slot)
480 {
481 	if (aclp->z_acl_count > 1) {
482 		(void) memmove(&aclp->z_acl[slot],
483 		    &aclp->z_acl[slot +1], sizeof (ace_t) *
484 		    (--aclp->z_acl_count - slot));
485 	} else
486 		aclp->z_acl_count--;
487 }
488 
489 /*
490  * Update access mask for prepended ACE
491  *
492  * This applies the "groupmask" value for aclmode property.
493  */
494 static void
495 zfs_acl_prepend_fixup(ace_t *acep, ace_t *origacep, mode_t mode, uid_t owner)
496 {
497 
498 	int	rmask, wmask, xmask;
499 	int	user_ace;
500 
501 	user_ace = (!(acep->a_flags &
502 	    (ACE_OWNER|ACE_GROUP|ACE_IDENTIFIER_GROUP)));
503 
504 	if (user_ace && (acep->a_who == owner)) {
505 		rmask = S_IRUSR;
506 		wmask = S_IWUSR;
507 		xmask = S_IXUSR;
508 	} else {
509 		rmask = S_IRGRP;
510 		wmask = S_IWGRP;
511 		xmask = S_IXGRP;
512 	}
513 
514 	if (origacep->a_access_mask & ACE_READ_DATA) {
515 		if (mode & rmask)
516 			acep->a_access_mask &= ~ACE_READ_DATA;
517 		else
518 			acep->a_access_mask |= ACE_READ_DATA;
519 	}
520 
521 	if (origacep->a_access_mask & ACE_WRITE_DATA) {
522 		if (mode & wmask)
523 			acep->a_access_mask &= ~ACE_WRITE_DATA;
524 		else
525 			acep->a_access_mask |= ACE_WRITE_DATA;
526 	}
527 
528 	if (origacep->a_access_mask & ACE_APPEND_DATA) {
529 		if (mode & wmask)
530 			acep->a_access_mask &= ~ACE_APPEND_DATA;
531 		else
532 			acep->a_access_mask |= ACE_APPEND_DATA;
533 	}
534 
535 	if (origacep->a_access_mask & ACE_EXECUTE) {
536 		if (mode & xmask)
537 			acep->a_access_mask &= ~ACE_EXECUTE;
538 		else
539 			acep->a_access_mask |= ACE_EXECUTE;
540 	}
541 }
542 
543 /*
544  * Apply mode to canonical six ACEs.
545  */
546 static void
547 zfs_acl_fixup_canonical_six(zfs_acl_t *aclp, mode_t mode)
548 {
549 	int	cnt;
550 	ace_t	*acep;
551 
552 	cnt = aclp->z_acl_count -1;
553 	acep = aclp->z_acl;
554 
555 	/*
556 	 * Fixup final ACEs to match the mode
557 	 */
558 
559 	ASSERT(cnt >= 5);
560 	adjust_ace_pair(&acep[cnt - 1], mode);	/* everyone@ */
561 	adjust_ace_pair(&acep[cnt - 3], (mode & 0070) >> 3);	/* group@ */
562 	adjust_ace_pair(&acep[cnt - 5], (mode & 0700) >> 6);	/* owner@ */
563 }
564 
565 
566 static int
567 zfs_acl_ace_match(ace_t *acep, int allow_deny, int type, int mask)
568 {
569 	return (acep->a_access_mask == mask && acep->a_type == allow_deny &&
570 	    ((acep->a_flags & 0xf040) == type));
571 }
572 
573 /*
574  * Can prepended ACE be reused?
575  */
576 static int
577 zfs_reuse_deny(ace_t *acep, int i)
578 {
579 	int okay_masks;
580 
581 	if (i < 1)
582 		return (B_FALSE);
583 
584 	if (acep[i-1].a_type != DENY)
585 		return (B_FALSE);
586 
587 	if (acep[i-1].a_flags != (acep[i].a_flags & ACE_IDENTIFIER_GROUP))
588 		return (B_FALSE);
589 
590 	okay_masks = (acep[i].a_access_mask & OKAY_MASK_BITS);
591 
592 	if (acep[i-1].a_access_mask & ~okay_masks)
593 		return (B_FALSE);
594 
595 	return (B_TRUE);
596 }
597 
598 /*
599  * Create space to prepend an ACE
600  */
601 static void
602 zfs_acl_prepend(zfs_acl_t *aclp, int i)
603 {
604 	ace_t	*oldaclp = NULL;
605 	ace_t	*to, *from;
606 	int	slots_left = aclp->z_slots - aclp->z_acl_count;
607 	int	oldslots;
608 	int	need_free = 0;
609 
610 	if (aclp->z_state == ACL_DATA_ALLOCED)
611 		ASSERT(aclp->z_slots >= aclp->z_acl_count);
612 
613 	if (slots_left == 0 || aclp->z_state != ACL_DATA_ALLOCED) {
614 
615 		to = kmem_alloc(ZFS_ACL_SIZE(aclp->z_acl_count +
616 		    OGE_PAD), KM_SLEEP);
617 		if (aclp->z_state == ACL_DATA_ALLOCED)
618 			need_free++;
619 		from = aclp->z_acl;
620 		oldaclp = aclp->z_acl;
621 		(void) memmove(to, from,
622 		    sizeof (ace_t) * aclp->z_acl_count);
623 		aclp->z_state = ACL_DATA_ALLOCED;
624 	} else {
625 		from = aclp->z_acl;
626 		to = aclp->z_acl;
627 	}
628 
629 
630 	(void) memmove(&to[i + 1], &from[i],
631 	    sizeof (ace_t) * (aclp->z_acl_count - i));
632 
633 	if (oldaclp) {
634 		aclp->z_acl = to;
635 		oldslots = aclp->z_slots;
636 		aclp->z_slots = aclp->z_acl_count + OGE_PAD;
637 		if (need_free)
638 			kmem_free(oldaclp, ZFS_ACL_SIZE(oldslots));
639 	}
640 
641 }
642 
643 /*
644  * Prepend deny ACE
645  */
646 static void
647 zfs_acl_prepend_deny(znode_t *zp, zfs_acl_t *aclp, int i,
648     mode_t mode)
649 {
650 	ace_t	*acep;
651 
652 	zfs_acl_prepend(aclp, i);
653 
654 	acep = aclp->z_acl;
655 	zfs_set_ace(&acep[i], 0, DENY, acep[i + 1].a_who,
656 	    (acep[i + 1].a_flags & 0xf040));
657 	zfs_acl_prepend_fixup(&acep[i], &acep[i+1], mode, zp->z_phys->zp_uid);
658 	aclp->z_acl_count++;
659 }
660 
661 /*
662  * Split an inherited ACE into inherit_only ACE
663  * and original ACE with inheritance flags stripped off.
664  */
665 static void
666 zfs_acl_split_ace(zfs_acl_t *aclp, int i)
667 {
668 	ace_t *acep = aclp->z_acl;
669 
670 	zfs_acl_prepend(aclp, i);
671 	acep = aclp->z_acl;
672 	acep[i] = acep[i + 1];
673 	acep[i].a_flags |= ACE_INHERIT_ONLY_ACE;
674 	acep[i + 1].a_flags &= ~ALL_INHERIT;
675 	aclp->z_acl_count++;
676 }
677 
678 /*
679  * Are ACES started at index i, the canonical six ACES?
680  */
681 static int
682 zfs_have_canonical_six(zfs_acl_t *aclp, int i)
683 {
684 	ace_t *acep = aclp->z_acl;
685 
686 	if ((zfs_acl_ace_match(&acep[i],
687 	    DENY, ACE_OWNER, 0) &&
688 	    zfs_acl_ace_match(&acep[i + 1], ALLOW, ACE_OWNER,
689 	    OWNER_ALLOW_MASK) && zfs_acl_ace_match(&acep[i + 2],
690 	    DENY, OWNING_GROUP, 0) && zfs_acl_ace_match(&acep[i + 3],
691 	    ALLOW, OWNING_GROUP, 0) && zfs_acl_ace_match(&acep[i + 4],
692 	    DENY, ACE_EVERYONE, EVERYONE_DENY_MASK) &&
693 	    zfs_acl_ace_match(&acep[i + 5], ALLOW, ACE_EVERYONE,
694 	    EVERYONE_ALLOW_MASK))) {
695 		return (1);
696 	} else {
697 		return (0);
698 	}
699 }
700 
701 /*
702  * Apply step 1g, to group entries
703  *
704  * Need to deal with corner case where group may have
705  * greater permissions than owner.  If so then limit
706  * group permissions, based on what extra permissions
707  * group has.
708  */
709 static void
710 zfs_fixup_group_entries(ace_t *acep, mode_t mode)
711 {
712 	mode_t extramode = (mode >> 3) & 07;
713 	mode_t ownermode = (mode >> 6);
714 
715 	if (acep[0].a_flags & ACE_IDENTIFIER_GROUP) {
716 
717 		extramode &= ~ownermode;
718 
719 		if (extramode) {
720 			if (extramode & 04) {
721 				acep[0].a_access_mask &= ~ACE_READ_DATA;
722 				acep[1].a_access_mask &= ~ACE_READ_DATA;
723 			}
724 			if (extramode & 02) {
725 				acep[0].a_access_mask &=
726 				    ~(ACE_WRITE_DATA|ACE_APPEND_DATA);
727 				acep[1].a_access_mask &=
728 				    ~(ACE_WRITE_DATA|ACE_APPEND_DATA);
729 			}
730 			if (extramode & 01) {
731 				acep[0].a_access_mask &= ~ACE_EXECUTE;
732 				acep[1].a_access_mask &= ~ACE_EXECUTE;
733 			}
734 		}
735 	}
736 }
737 
738 /*
739  * Apply the chmod algorithm as described
740  * in PSARC/2002/240
741  */
742 static int
743 zfs_acl_chmod(znode_t *zp, uint64_t mode, zfs_acl_t *aclp,
744     dmu_tx_t *tx)
745 {
746 	zfsvfs_t	*zfsvfs = zp->z_zfsvfs;
747 	ace_t 		*acep;
748 	int 		i;
749 	int		error;
750 	int 		entry_type;
751 	int 		reuse_deny;
752 	int 		need_canonical_six = 1;
753 
754 	ASSERT(MUTEX_HELD(&zp->z_acl_lock));
755 	ASSERT(MUTEX_HELD(&zp->z_lock));
756 
757 	i = 0;
758 	while (i < aclp->z_acl_count) {
759 		acep = aclp->z_acl;
760 		entry_type = (acep[i].a_flags & 0xf040);
761 
762 		if ((acep[i].a_type != ALLOW && acep[i].a_type != DENY) ||
763 		    (acep[i].a_flags & ACE_INHERIT_ONLY_ACE)) {
764 			i++;
765 			continue;
766 		}
767 
768 
769 		if (zfsvfs->z_acl_mode == DISCARD) {
770 			zfs_ace_remove(aclp, i);
771 			continue;
772 		}
773 
774 		/*
775 		 * Need to split ace into two?
776 		 */
777 		if ((acep[i].a_flags & (ACE_FILE_INHERIT_ACE|
778 		    ACE_DIRECTORY_INHERIT_ACE)) &&
779 		    (!(acep[i].a_flags & ACE_INHERIT_ONLY_ACE))) {
780 			zfs_acl_split_ace(aclp, i);
781 			i++;
782 			continue;
783 		}
784 
785 		if (entry_type == ACE_OWNER || entry_type == ACE_EVERYONE ||
786 		    (entry_type == OWNING_GROUP)) {
787 			acep[i].a_access_mask &= ~OGE_CLEAR;
788 			i++;
789 			continue;
790 
791 		} else {
792 			if (acep[i].a_type == ALLOW) {
793 
794 				/*
795 				 * Check preceding ACE if any, to see
796 				 * if we need to prepend a DENY ACE.
797 				 * This is only applicable when the acl_mode
798 				 * property == groupmask.
799 				 */
800 				if (zfsvfs->z_acl_mode == GROUPMASK) {
801 
802 					reuse_deny = zfs_reuse_deny(acep, i);
803 
804 					if (reuse_deny == B_FALSE) {
805 						zfs_acl_prepend_deny(zp, aclp,
806 						    i, mode);
807 						i++;
808 						acep = aclp->z_acl;
809 					} else {
810 						zfs_acl_prepend_fixup(
811 						    &acep[i - 1],
812 						    &acep[i], mode,
813 						    zp->z_phys->zp_uid);
814 					}
815 					zfs_fixup_group_entries(&acep[i - 1],
816 					    mode);
817 				}
818 			}
819 			i++;
820 		}
821 	}
822 
823 	/*
824 	 * Check out last six aces, if we have six.
825 	 */
826 
827 	if (aclp->z_acl_count >= 6) {
828 		i = aclp->z_acl_count - 6;
829 
830 		if (zfs_have_canonical_six(aclp, i)) {
831 			need_canonical_six = 0;
832 		}
833 	}
834 
835 	if (need_canonical_six) {
836 
837 		zfs_acl_append(aclp, 6);
838 		i = aclp->z_acl_count;
839 		acep = aclp->z_acl;
840 		zfs_set_ace(&acep[i++], 0, DENY, -1, ACE_OWNER);
841 		zfs_set_ace(&acep[i++], OWNER_ALLOW_MASK, ALLOW, -1, ACE_OWNER);
842 		zfs_set_ace(&acep[i++], 0, DENY, -1, OWNING_GROUP);
843 		zfs_set_ace(&acep[i++], 0, ALLOW, -1, OWNING_GROUP);
844 		zfs_set_ace(&acep[i++], EVERYONE_DENY_MASK,
845 		    DENY, -1, ACE_EVERYONE);
846 		zfs_set_ace(&acep[i++], EVERYONE_ALLOW_MASK,
847 		    ALLOW, -1, ACE_EVERYONE);
848 		aclp->z_acl_count += 6;
849 	}
850 
851 	zfs_acl_fixup_canonical_six(aclp, mode);
852 
853 	zp->z_phys->zp_mode = mode;
854 	error = zfs_aclset_common(zp, aclp, tx, NULL);
855 	return (error);
856 }
857 
858 
859 int
860 zfs_acl_chmod_setattr(znode_t *zp, uint64_t mode, dmu_tx_t *tx)
861 {
862 	zfs_acl_t *aclp;
863 	int error;
864 
865 	ASSERT(MUTEX_HELD(&zp->z_lock));
866 	mutex_enter(&zp->z_acl_lock);
867 	aclp = zfs_acl_node_read(zp);
868 	error = zfs_acl_chmod(zp, mode, aclp, tx);
869 	mutex_exit(&zp->z_acl_lock);
870 	zfs_acl_free(aclp);
871 	return (error);
872 }
873 
874 /*
875  * strip off write_owner and write_acl
876  */
877 static void
878 zfs_securemode_update(zfsvfs_t *zfsvfs, ace_t *acep)
879 {
880 	if ((zfsvfs->z_acl_inherit == SECURE) &&
881 	    acep->a_type == ALLOW)
882 		acep->a_access_mask &= ~SECURE_NO_INHERIT;
883 }
884 
885 /*
886  * inherit inheritable ACEs from parent
887  */
888 static zfs_acl_t *
889 zfs_acl_inherit(znode_t *zp, zfs_acl_t *paclp)
890 {
891 	zfsvfs_t	*zfsvfs = zp->z_zfsvfs;
892 	ace_t 		*pacep;
893 	ace_t		*acep;
894 	int 		ace_cnt = 0;
895 	int		pace_cnt;
896 	int 		i, j;
897 	zfs_acl_t	*aclp = NULL;
898 
899 	i = j = 0;
900 	pace_cnt = paclp->z_acl_count;
901 	pacep = paclp->z_acl;
902 	if (zfsvfs->z_acl_inherit != DISCARD) {
903 		for (i = 0; i != pace_cnt; i++) {
904 
905 			if (zfsvfs->z_acl_inherit == NOALLOW &&
906 			    pacep[i].a_type == ALLOW)
907 				continue;
908 
909 			if (zfs_ace_can_use(zp, &pacep[i])) {
910 				ace_cnt++;
911 				if (!(pacep[i].a_flags &
912 				    ACE_NO_PROPAGATE_INHERIT_ACE))
913 					ace_cnt++;
914 			}
915 		}
916 	}
917 
918 	aclp = zfs_acl_alloc(ace_cnt + OGE_PAD);
919 	if (ace_cnt && zfsvfs->z_acl_inherit != DISCARD) {
920 		acep = aclp->z_acl;
921 		pacep = paclp->z_acl;
922 		for (i = 0; i != pace_cnt; i++) {
923 
924 			if (zfsvfs->z_acl_inherit == NOALLOW &&
925 			    pacep[i].a_type == ALLOW)
926 				continue;
927 
928 			if (zfs_ace_can_use(zp, &pacep[i])) {
929 				/*
930 				 * Now create entry for inherited ace
931 				 */
932 				acep[j] = pacep[i];
933 
934 				if (pacep[i].a_flags &
935 				    ACE_NO_PROPAGATE_INHERIT_ACE) {
936 					acep[j].a_flags &= ~ALL_INHERIT;
937 					j++;
938 					continue;
939 				}
940 
941 				if (pacep[i].a_type != ALLOW &&
942 				    pacep[i].a_type != DENY) {
943 					zfs_securemode_update(zfsvfs, &acep[j]);
944 					j++;
945 					continue;
946 				}
947 
948 				if (ZTOV(zp)->v_type != VDIR) {
949 					acep[j].a_flags &= ~ALL_INHERIT;
950 					zfs_securemode_update(zfsvfs, &acep[j]);
951 					j++;
952 					continue;
953 				}
954 
955 				ASSERT(ZTOV(zp)->v_type == VDIR);
956 
957 				/*
958 				 * If we are inheriting an ACE targeted for
959 				 * only files, then leave the inherit_only
960 				 * one for future propagation.
961 				 */
962 				if ((acep[j].a_flags & (ACE_FILE_INHERIT_ACE |
963 				    ACE_DIRECTORY_INHERIT_ACE)) !=
964 				    ACE_FILE_INHERIT_ACE)
965 					acep[j].a_flags &=
966 					    ~ACE_INHERIT_ONLY_ACE;
967 
968 				zfs_securemode_update(zfsvfs, &acep[j]);
969 				j++;
970 			}
971 		}
972 	}
973 	aclp->z_acl_count = j;
974 	ASSERT(aclp->z_slots >= aclp->z_acl_count);
975 
976 	return (aclp);
977 }
978 
979 /*
980  * Create file system object initial permissions
981  * including inheritable ACEs.
982  */
983 void
984 zfs_perm_init(znode_t *zp, znode_t *parent, int flag,
985     vattr_t *vap, dmu_tx_t *tx, cred_t *cr)
986 {
987 	uint64_t	mode;
988 	uid_t		uid;
989 	gid_t		gid;
990 	int		error;
991 	int		pull_down;
992 	zfs_acl_t	*aclp, *paclp;
993 
994 	mode = MAKEIMODE(vap->va_type, vap->va_mode);
995 
996 	/*
997 	 * Determine uid and gid.
998 	 */
999 	if ((flag & (IS_ROOT_NODE | IS_REPLAY)) ||
1000 	    ((flag & IS_XATTR) && (vap->va_type == VDIR))) {
1001 		uid = vap->va_uid;
1002 		gid = vap->va_gid;
1003 	} else {
1004 		uid = crgetuid(cr);
1005 		if ((vap->va_mask & AT_GID) &&
1006 		    ((vap->va_gid == parent->z_phys->zp_gid) ||
1007 		    groupmember(vap->va_gid, cr) ||
1008 		    secpolicy_vnode_create_gid(cr)))
1009 			gid = vap->va_gid;
1010 		else
1011 			gid = (parent->z_phys->zp_mode & S_ISGID) ?
1012 			    parent->z_phys->zp_gid : crgetgid(cr);
1013 	}
1014 
1015 	/*
1016 	 * If we're creating a directory, and the parent directory has the
1017 	 * set-GID bit set, set in on the new directory.
1018 	 * Otherwise, if the user is neither privileged nor a member of the
1019 	 * file's new group, clear the file's set-GID bit.
1020 	 */
1021 
1022 	if ((parent->z_phys->zp_mode & S_ISGID) && (vap->va_type == VDIR))
1023 		mode |= S_ISGID;
1024 	else {
1025 		if ((mode & S_ISGID) &&
1026 		    secpolicy_vnode_setids_setgids(cr, gid) != 0)
1027 			mode &= ~S_ISGID;
1028 	}
1029 
1030 	zp->z_phys->zp_uid = uid;
1031 	zp->z_phys->zp_gid = gid;
1032 	zp->z_phys->zp_mode = mode;
1033 
1034 	mutex_enter(&parent->z_lock);
1035 	pull_down = (parent->z_phys->zp_flags & ZFS_INHERIT_ACE);
1036 	if (pull_down) {
1037 		mutex_enter(&parent->z_acl_lock);
1038 		paclp = zfs_acl_node_read(parent);
1039 		mutex_exit(&parent->z_acl_lock);
1040 		aclp = zfs_acl_inherit(zp, paclp);
1041 		zfs_acl_free(paclp);
1042 	} else {
1043 		aclp = zfs_acl_alloc(6);
1044 	}
1045 	mutex_exit(&parent->z_lock);
1046 	mutex_enter(&zp->z_lock);
1047 	mutex_enter(&zp->z_acl_lock);
1048 	error = zfs_acl_chmod(zp, mode, aclp, tx);
1049 	mutex_exit(&zp->z_lock);
1050 	mutex_exit(&zp->z_acl_lock);
1051 	ASSERT3U(error, ==, 0);
1052 	zfs_acl_free(aclp);
1053 }
1054 
1055 /*
1056  * Can use be used for inheritance
1057  */
1058 static int
1059 zfs_ace_can_use(znode_t *zp, ace_t *acep)
1060 {
1061 	int vtype = ZTOV(zp)->v_type;
1062 
1063 	int	iflags = (acep->a_flags & 0xf);
1064 
1065 	if ((vtype == VDIR) && (iflags & ACE_DIRECTORY_INHERIT_ACE))
1066 		return (1);
1067 
1068 	else if (iflags & ACE_FILE_INHERIT_ACE)
1069 		return (1);
1070 
1071 	return (0);
1072 }
1073 
1074 /*
1075  * Retrieve a files ACL
1076  */
1077 int
1078 zfs_getacl(znode_t *zp, vsecattr_t  *vsecp, cred_t *cr)
1079 {
1080 	zfs_acl_t	*aclp;
1081 	ulong_t		mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT);
1082 	int		error;
1083 
1084 	if (error = zfs_zaccess(zp, ACE_READ_ACL, cr)) {
1085 		/*
1086 		 * If owner of file then allow reading of the
1087 		 * ACL.
1088 		 */
1089 		if (crgetuid(cr) != zp->z_phys->zp_uid)
1090 			return (error);
1091 	}
1092 
1093 	if (mask == 0)
1094 		return (ENOSYS);
1095 
1096 	mutex_enter(&zp->z_acl_lock);
1097 
1098 	aclp = zfs_acl_node_read(zp);
1099 
1100 	if (mask & VSA_ACECNT) {
1101 		vsecp->vsa_aclcnt = aclp->z_acl_count;
1102 	}
1103 
1104 	if (mask & VSA_ACE) {
1105 		vsecp->vsa_aclentp = kmem_alloc(aclp->z_acl_count *
1106 		    sizeof (ace_t), KM_SLEEP);
1107 		bcopy(aclp->z_acl, vsecp->vsa_aclentp,
1108 		    aclp->z_acl_count * sizeof (ace_t));
1109 	}
1110 
1111 	mutex_exit(&zp->z_acl_lock);
1112 
1113 	zfs_acl_free(aclp);
1114 
1115 	return (0);
1116 }
1117 
1118 /*
1119  * Set a files ACL
1120  */
1121 int
1122 zfs_setacl(znode_t *zp, vsecattr_t *vsecp, cred_t *cr)
1123 {
1124 	zfsvfs_t	*zfsvfs = zp->z_zfsvfs;
1125 	zilog_t		*zilog = zfsvfs->z_log;
1126 	ace_t		*acep = vsecp->vsa_aclentp;
1127 	int		aclcnt = vsecp->vsa_aclcnt;
1128 	ulong_t		mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT);
1129 	dmu_tx_t	*tx;
1130 	int		error;
1131 	int		inherit;
1132 	zfs_acl_t	*aclp;
1133 	uint64_t	seq = 0;
1134 
1135 	if (mask == 0)
1136 		return (EINVAL);
1137 
1138 	if (!zfs_acl_valid(zp, acep, aclcnt, &inherit))
1139 		return (EINVAL);
1140 top:
1141 	error = zfs_zaccess_v4_perm(zp, ACE_WRITE_ACL, cr);
1142 	if (error == EACCES || error == ACCESS_UNDETERMINED) {
1143 		if ((error = secpolicy_vnode_setdac(cr,
1144 		    zp->z_phys->zp_uid)) != 0) {
1145 			return (error);
1146 		}
1147 	} else if (error) {
1148 		return (error == EROFS ? error : EPERM);
1149 	}
1150 
1151 	mutex_enter(&zp->z_lock);
1152 	mutex_enter(&zp->z_acl_lock);
1153 
1154 	tx = dmu_tx_create(zfsvfs->z_os);
1155 	dmu_tx_hold_bonus(tx, zp->z_id);
1156 
1157 	if (zp->z_phys->zp_acl.z_acl_extern_obj) {
1158 		dmu_tx_hold_write(tx, zp->z_phys->zp_acl.z_acl_extern_obj,
1159 		    0, ZFS_ACL_SIZE(aclcnt));
1160 	} else if (aclcnt > ACE_SLOT_CNT) {
1161 		dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0, ZFS_ACL_SIZE(aclcnt));
1162 	}
1163 
1164 	error = dmu_tx_assign(tx, zfsvfs->z_assign);
1165 	if (error) {
1166 		dmu_tx_abort(tx);
1167 
1168 		mutex_exit(&zp->z_acl_lock);
1169 		mutex_exit(&zp->z_lock);
1170 
1171 		if (error == ERESTART && zfsvfs->z_assign == TXG_NOWAIT) {
1172 			txg_wait_open(dmu_objset_pool(zfsvfs->z_os), 0);
1173 			goto top;
1174 		}
1175 		return (error);
1176 	}
1177 
1178 	aclp = zfs_acl_alloc(aclcnt);
1179 	bcopy(acep, aclp->z_acl, sizeof (ace_t) * aclcnt);
1180 	aclp->z_acl_count = aclcnt;
1181 	error = zfs_aclset_common(zp, aclp, tx, &inherit);
1182 	ASSERT(error == 0);
1183 
1184 	zfs_acl_free(aclp);
1185 	seq = zfs_log_acl(zilog, tx, TX_ACL, zp, aclcnt, acep);
1186 	dmu_tx_commit(tx);
1187 done:
1188 	mutex_exit(&zp->z_acl_lock);
1189 	mutex_exit(&zp->z_lock);
1190 
1191 	zil_commit(zilog, seq, 0);
1192 
1193 	return (error);
1194 }
1195 
1196 static int
1197 zfs_ace_access(ace_t *zacep, int mode_wanted, int *working_mode)
1198 {
1199 	if ((*working_mode & mode_wanted) == mode_wanted) {
1200 		return (0);
1201 	}
1202 
1203 	if (zacep->a_access_mask & mode_wanted) {
1204 		if (zacep->a_type == ALLOW) {
1205 			*working_mode |= (mode_wanted & zacep->a_access_mask);
1206 			if ((*working_mode & mode_wanted) == mode_wanted)
1207 				return (0);
1208 		} else if (zacep->a_type == DENY) {
1209 			return (EACCES);
1210 		}
1211 	}
1212 
1213 	/*
1214 	 * haven't been specifcally denied at this point
1215 	 * so return UNDETERMINED.
1216 	 */
1217 
1218 	return (ACCESS_UNDETERMINED);
1219 }
1220 
1221 
1222 static int
1223 zfs_zaccess_common(znode_t *zp, int v4_mode, int *working_mode, cred_t *cr)
1224 {
1225 	zfs_acl_t	*aclp;
1226 	zfsvfs_t	*zfsvfs = zp->z_zfsvfs;
1227 	ace_t		*zacep;
1228 	gid_t		gid;
1229 	int		mode_wanted = v4_mode;
1230 	int		cnt;
1231 	int		i;
1232 	int		access_deny = ACCESS_UNDETERMINED;
1233 	uint_t		entry_type;
1234 	uid_t		uid = crgetuid(cr);
1235 
1236 	*working_mode = 0;
1237 
1238 	if (zfsvfs->z_assign >= TXG_INITIAL)		/* ZIL replay */
1239 		return (0);
1240 
1241 	if ((v4_mode & WRITE_MASK) &&
1242 	    (zp->z_zfsvfs->z_vfs->vfs_flag & VFS_RDONLY) &&
1243 	    (!IS_DEVVP(ZTOV(zp)))) {
1244 		return (EROFS);
1245 	}
1246 
1247 	mutex_enter(&zp->z_acl_lock);
1248 
1249 	aclp = zfs_acl_node_read(zp);
1250 
1251 	zacep = aclp->z_acl;
1252 	cnt = aclp->z_acl_count;
1253 
1254 	for (i = 0; i != cnt; i++) {
1255 
1256 		if (zacep[i].a_flags & ACE_INHERIT_ONLY_ACE)
1257 			continue;
1258 
1259 		entry_type = (zacep[i].a_flags & 0xf040);
1260 		switch (entry_type) {
1261 		case ACE_OWNER:
1262 			if (uid == zp->z_phys->zp_uid) {
1263 				access_deny = zfs_ace_access(&zacep[i],
1264 				    mode_wanted, working_mode);
1265 			}
1266 			break;
1267 		case (ACE_IDENTIFIER_GROUP | ACE_GROUP):
1268 		case ACE_IDENTIFIER_GROUP:
1269 			/*
1270 			 * Owning group gid is in znode not ACL
1271 			 */
1272 			if (entry_type == (ACE_IDENTIFIER_GROUP | ACE_GROUP))
1273 				gid = zp->z_phys->zp_gid;
1274 			else
1275 				gid = zacep[i].a_who;
1276 
1277 			if (groupmember(gid, cr)) {
1278 				access_deny = zfs_ace_access(&zacep[i],
1279 				    mode_wanted, working_mode);
1280 			}
1281 			break;
1282 		case ACE_EVERYONE:
1283 			access_deny = zfs_ace_access(&zacep[i],
1284 			    mode_wanted, working_mode);
1285 			break;
1286 
1287 		/* USER Entry */
1288 		default:
1289 			if (entry_type == 0) {
1290 				if (uid == zacep[i].a_who) {
1291 					access_deny = zfs_ace_access(&zacep[i],
1292 					    mode_wanted, working_mode);
1293 				}
1294 				break;
1295 			}
1296 			zfs_acl_free(aclp);
1297 			mutex_exit(&zp->z_acl_lock);
1298 			return (EIO);
1299 		}
1300 
1301 		if (access_deny != ACCESS_UNDETERMINED)
1302 			break;
1303 
1304 	}
1305 
1306 	mutex_exit(&zp->z_acl_lock);
1307 	zfs_acl_free(aclp);
1308 
1309 	return (access_deny);
1310 }
1311 
1312 
1313 /*
1314  * Determine whether Access should be granted/denied, invoking least
1315  * priv subsytem when a deny is determined.
1316  */
1317 int
1318 zfs_zaccess(znode_t *zp, int mode, cred_t *cr)
1319 {
1320 	int	working_mode = 0;
1321 	int	error;
1322 	int	is_attr;
1323 	znode_t	*xzp;
1324 	znode_t *check_zp = zp;
1325 
1326 	is_attr = ((zp->z_phys->zp_flags & ZFS_XATTR) &&
1327 	    (ZTOV(zp)->v_type == VDIR));
1328 
1329 	/*
1330 	 * If attribute then validate against base file
1331 	 */
1332 	if (is_attr) {
1333 		if ((error = zfs_zget(zp->z_zfsvfs,
1334 		    zp->z_phys->zp_parent, &xzp)) != 0)	{
1335 			return (error);
1336 		}
1337 		check_zp = xzp;
1338 		/*
1339 		 * fixup mode to map to xattr perms
1340 		 */
1341 
1342 		if (mode & (ACE_WRITE_DATA|ACE_APPEND_DATA)) {
1343 			mode &= ~(ACE_WRITE_DATA|ACE_APPEND_DATA);
1344 			mode |= ACE_WRITE_NAMED_ATTRS;
1345 		}
1346 
1347 		if (mode & (ACE_READ_DATA|ACE_EXECUTE)) {
1348 			mode &= ~(ACE_READ_DATA|ACE_EXECUTE);
1349 			mode |= ACE_READ_NAMED_ATTRS;
1350 		}
1351 	}
1352 
1353 	error = zfs_zaccess_common(check_zp, mode, &working_mode, cr);
1354 
1355 	if (error == EROFS) {
1356 		if (is_attr)
1357 			VN_RELE(ZTOV(xzp));
1358 		return (error);
1359 	}
1360 
1361 	if (error || (working_mode != mode)) {
1362 		error = secpolicy_vnode_access(cr, ZTOV(check_zp),
1363 		    check_zp->z_phys->zp_uid, ~zfs_v4_to_unix(working_mode));
1364 	}
1365 
1366 	if (is_attr)
1367 		VN_RELE(ZTOV(xzp));
1368 
1369 	return (error);
1370 }
1371 
1372 /*
1373  * Special zaccess function to check for special nfsv4 perm.
1374  * doesn't call secpolicy_vnode_access() for failure, since that
1375  * would probably be the wrong policy function to call.
1376  * instead its up to the caller to handle that situation.
1377  */
1378 
1379 int
1380 zfs_zaccess_v4_perm(znode_t *zp, int mode, cred_t *cr)
1381 {
1382 	int working_mode = 0;
1383 	return (zfs_zaccess_common(zp, mode, &working_mode, cr));
1384 }
1385 
1386 /*
1387  * Translate tradition unix VREAD/VWRITE/VEXEC mode into
1388  * native ACL format and call zfs_zaccess()
1389  */
1390 int
1391 zfs_zaccess_rwx(znode_t *zp, mode_t mode, cred_t *cr)
1392 {
1393 	int v4_mode = zfs_unix_to_v4(mode >> 6);
1394 
1395 	return (zfs_zaccess(zp, v4_mode, cr));
1396 }
1397 
1398 /*
1399  * Determine whether Access should be granted/deny, without
1400  * consulting least priv subsystem.
1401  *
1402  *
1403  * The following chart is the recommended NFSv4 enforcement for
1404  * ability to delete an object.
1405  *
1406  *      -------------------------------------------------------
1407  *      |   Parent Dir  |           Target Object Permissions |
1408  *      |  permissions  |                                     |
1409  *      -------------------------------------------------------
1410  *      |               | ACL Allows | ACL Denies| Delete     |
1411  *      |               |  Delete    |  Delete   | unspecified|
1412  *      -------------------------------------------------------
1413  *      |  ACL Allows   | Permit     | Permit    | Permit     |
1414  *      |  DELETE_CHILD |                                     |
1415  *      -------------------------------------------------------
1416  *      |  ACL Denies   | Permit     | Deny      | Deny       |
1417  *      |  DELETE_CHILD |            |           |            |
1418  *      -------------------------------------------------------
1419  *      | ACL specifies |            |           |            |
1420  *      | only allow    | Permit     | Permit    | Permit     |
1421  *      | write and     |            |           |            |
1422  *      | execute       |            |           |            |
1423  *      -------------------------------------------------------
1424  *      | ACL denies    |            |           |            |
1425  *      | write and     | Permit     | Deny      | Deny       |
1426  *      | execute       |            |           |            |
1427  *      -------------------------------------------------------
1428  *         ^
1429  *         |
1430  *         No search privilege, can't even look up file?
1431  *
1432  */
1433 int
1434 zfs_zaccess_delete(znode_t *dzp, znode_t *zp, cred_t *cr)
1435 {
1436 	int dzp_working_mode = 0;
1437 	int zp_working_mode = 0;
1438 	int dzp_error, zp_error;
1439 
1440 	/*
1441 	 * Arghh, this check is going to require a couple of questions
1442 	 * to be asked.  We want specific DELETE permissions to
1443 	 * take precedence over WRITE/EXECUTE.  We don't
1444 	 * want an ACL such as this to mess us up.
1445 	 * user:sloar:write_data:deny,user:sloar:delete:allow
1446 	 *
1447 	 * However, deny permissions may ultimately be overridden
1448 	 * by secpolicy_vnode_access().
1449 	 */
1450 
1451 	dzp_error = zfs_zaccess_common(dzp, ACE_DELETE_CHILD,
1452 	    &dzp_working_mode, cr);
1453 	zp_error = zfs_zaccess_common(zp, ACE_DELETE, &zp_working_mode, cr);
1454 
1455 	if (dzp_error == EROFS || zp_error == EROFS)
1456 		return (dzp_error);
1457 
1458 	/*
1459 	 * First handle the first row
1460 	 */
1461 	if (dzp_working_mode & ACE_DELETE_CHILD)
1462 		return (0);
1463 
1464 	/*
1465 	 * Second row
1466 	 */
1467 
1468 	if (zp_working_mode & ACE_DELETE)
1469 		return (0);
1470 
1471 	/*
1472 	 * Third Row
1473 	 */
1474 
1475 	dzp_error = zfs_zaccess_common(dzp, ACE_WRITE_DATA|ACE_EXECUTE,
1476 	    &dzp_working_mode, cr);
1477 
1478 	if (dzp_error == EROFS)
1479 		return (dzp_error);
1480 
1481 	if (dzp_working_mode & (ACE_WRITE_DATA|ACE_EXECUTE))
1482 		return (0);
1483 
1484 	/*
1485 	 * Fourth Row
1486 	 */
1487 
1488 	if (((dzp_working_mode & (ACE_WRITE_DATA|ACE_EXECUTE)) == 0) &&
1489 	    (zp_working_mode & ACE_DELETE))
1490 		return (0);
1491 
1492 	return (secpolicy_vnode_access(cr, ZTOV(zp), dzp->z_phys->zp_uid,
1493 	    S_IWRITE|S_IEXEC));
1494 }
1495 
1496 int
1497 zfs_zaccess_rename(znode_t *sdzp, znode_t *szp, znode_t *tdzp,
1498     znode_t *tzp, cred_t *cr)
1499 {
1500 	int add_perm;
1501 	int error;
1502 
1503 	add_perm = (ZTOV(szp)->v_type == VDIR) ?
1504 	    ACE_ADD_SUBDIRECTORY : ACE_ADD_FILE;
1505 
1506 	/*
1507 	 * Rename permissions are combination of delete permission +
1508 	 * add file/subdir permission.
1509 	 */
1510 
1511 	/*
1512 	 * first make sure we do the delete portion.
1513 	 *
1514 	 * If that succeeds then check for add_file/add_subdir permissions
1515 	 */
1516 
1517 	if (error = zfs_zaccess_delete(sdzp, szp, cr))
1518 		return (error);
1519 
1520 	/*
1521 	 * If we have a tzp, see if we can delete it?
1522 	 */
1523 	if (tzp) {
1524 		if (error = zfs_zaccess_delete(tdzp, tzp, cr))
1525 			return (error);
1526 	}
1527 
1528 	/*
1529 	 * Now check for add permissions
1530 	 */
1531 	if (error = zfs_zaccess(sdzp, add_perm, cr))
1532 		return (error);
1533 
1534 	error = zfs_sticky_remove_access(sdzp, szp, cr);
1535 
1536 	return (error);
1537 }
1538