zfs_acl.c

Version: - FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
    1 /*
    2  * CDDL HEADER START
    3  *
    4  * The contents of this file are subject to the terms of the
    5  * Common Development and Distribution License (the "License").
    6  * You may not use this file except in compliance with the License.
    7  *
    8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
    9  * or https://opensource.org/licenses/CDDL-1.0.
   10  * See the License for the specific language governing permissions
   11  * and limitations under the License.
   12  *
   13  * When distributing Covered Code, include this CDDL HEADER in each
   14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
   15  * If applicable, add the following below this CDDL HEADER, with the
   16  * fields enclosed by brackets "[]" replaced with your own identifying
   17  * information: Portions Copyright [yyyy] [name of copyright owner]
   18  *
   19  * CDDL HEADER END
   20  */
   21 /*
   22  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
   23  * Copyright (c) 2013 by Delphix. All rights reserved.
   24  * Copyright 2014 Nexenta Systems, Inc.  All rights reserved.
   25  */
   26 
   27 
   28 #include <sys/types.h>
   29 #include <sys/param.h>
   30 #include <sys/time.h>
   31 #include <sys/sysmacros.h>
   32 #include <sys/vfs.h>
   33 #include <sys/vnode.h>
   34 #include <sys/sid.h>
   35 #include <sys/file.h>
   36 #include <sys/stat.h>
   37 #include <sys/kmem.h>
   38 #include <sys/cmn_err.h>
   39 #include <sys/errno.h>
   40 #include <sys/fs/zfs.h>
   41 #include <sys/policy.h>
   42 #include <sys/zfs_znode.h>
   43 #include <sys/zfs_fuid.h>
   44 #include <sys/zfs_acl.h>
   45 #include <sys/zfs_dir.h>
   46 #include <sys/zfs_quota.h>
   47 #include <sys/zfs_vfsops.h>
   48 #include <sys/dmu.h>
   49 #include <sys/dnode.h>
   50 #include <sys/zap.h>
   51 #include <sys/sa.h>
   52 #include <sys/trace_acl.h>
   53 #include <sys/zpl.h>
   54 
   55 #define ALLOW   ACE_ACCESS_ALLOWED_ACE_TYPE
   56 #define DENY    ACE_ACCESS_DENIED_ACE_TYPE
   57 #define MAX_ACE_TYPE    ACE_SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE
   58 #define MIN_ACE_TYPE    ALLOW
   59 
   60 #define OWNING_GROUP            (ACE_GROUP|ACE_IDENTIFIER_GROUP)
   61 #define EVERYONE_ALLOW_MASK (ACE_READ_ACL|ACE_READ_ATTRIBUTES | \
   62     ACE_READ_NAMED_ATTRS|ACE_SYNCHRONIZE)
   63 #define EVERYONE_DENY_MASK (ACE_WRITE_ACL|ACE_WRITE_OWNER | \
   64     ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS)
   65 #define OWNER_ALLOW_MASK (ACE_WRITE_ACL | ACE_WRITE_OWNER | \
   66     ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS)
   67 
   68 #define ZFS_CHECKED_MASKS (ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_READ_DATA| \
   69     ACE_READ_NAMED_ATTRS|ACE_WRITE_DATA|ACE_WRITE_ATTRIBUTES| \
   70     ACE_WRITE_NAMED_ATTRS|ACE_APPEND_DATA|ACE_EXECUTE|ACE_WRITE_OWNER| \
   71     ACE_WRITE_ACL|ACE_DELETE|ACE_DELETE_CHILD|ACE_SYNCHRONIZE)
   72 
   73 #define WRITE_MASK_DATA (ACE_WRITE_DATA|ACE_APPEND_DATA|ACE_WRITE_NAMED_ATTRS)
   74 #define WRITE_MASK_ATTRS (ACE_WRITE_ACL|ACE_WRITE_OWNER|ACE_WRITE_ATTRIBUTES| \
   75     ACE_DELETE|ACE_DELETE_CHILD)
   76 #define WRITE_MASK (WRITE_MASK_DATA|WRITE_MASK_ATTRS)
   77 
   78 #define OGE_CLEAR       (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \
   79     ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE)
   80 
   81 #define OKAY_MASK_BITS (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \
   82     ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE)
   83 
   84 #define ALL_INHERIT     (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE | \
   85     ACE_NO_PROPAGATE_INHERIT_ACE|ACE_INHERIT_ONLY_ACE|ACE_INHERITED_ACE)
   86 
   87 #define RESTRICTED_CLEAR        (ACE_WRITE_ACL|ACE_WRITE_OWNER)
   88 
   89 #define V4_ACL_WIDE_FLAGS (ZFS_ACL_AUTO_INHERIT|ZFS_ACL_DEFAULTED|\
   90     ZFS_ACL_PROTECTED)
   91 
   92 #define ZFS_ACL_WIDE_FLAGS (V4_ACL_WIDE_FLAGS|ZFS_ACL_TRIVIAL|ZFS_INHERIT_ACE|\
   93     ZFS_ACL_OBJ_ACE)
   94 
   95 #define ALL_MODE_EXECS (S_IXUSR | S_IXGRP | S_IXOTH)
   96 
   97 #define IDMAP_WK_CREATOR_OWNER_UID      2147483648U
   98 
   99 static uint16_t
  100 zfs_ace_v0_get_type(void *acep)
  101 {
  102         return (((zfs_oldace_t *)acep)->z_type);
  103 }
  104 
  105 static uint16_t
  106 zfs_ace_v0_get_flags(void *acep)
  107 {
  108         return (((zfs_oldace_t *)acep)->z_flags);
  109 }
  110 
  111 static uint32_t
  112 zfs_ace_v0_get_mask(void *acep)
  113 {
  114         return (((zfs_oldace_t *)acep)->z_access_mask);
  115 }
  116 
  117 static uint64_t
  118 zfs_ace_v0_get_who(void *acep)
  119 {
  120         return (((zfs_oldace_t *)acep)->z_fuid);
  121 }
  122 
  123 static void
  124 zfs_ace_v0_set_type(void *acep, uint16_t type)
  125 {
  126         ((zfs_oldace_t *)acep)->z_type = type;
  127 }
  128 
  129 static void
  130 zfs_ace_v0_set_flags(void *acep, uint16_t flags)
  131 {
  132         ((zfs_oldace_t *)acep)->z_flags = flags;
  133 }
  134 
  135 static void
  136 zfs_ace_v0_set_mask(void *acep, uint32_t mask)
  137 {
  138         ((zfs_oldace_t *)acep)->z_access_mask = mask;
  139 }
  140 
  141 static void
  142 zfs_ace_v0_set_who(void *acep, uint64_t who)
  143 {
  144         ((zfs_oldace_t *)acep)->z_fuid = who;
  145 }
  146 
  147 static size_t
  148 zfs_ace_v0_size(void *acep)
  149 {
  150         (void) acep;
  151         return (sizeof (zfs_oldace_t));
  152 }
  153 
  154 static size_t
  155 zfs_ace_v0_abstract_size(void)
  156 {
  157         return (sizeof (zfs_oldace_t));
  158 }
  159 
  160 static int
  161 zfs_ace_v0_mask_off(void)
  162 {
  163         return (offsetof(zfs_oldace_t, z_access_mask));
  164 }
  165 
  166 static int
  167 zfs_ace_v0_data(void *acep, void **datap)
  168 {
  169         (void) acep;
  170         *datap = NULL;
  171         return (0);
  172 }
  173 
  174 static const acl_ops_t zfs_acl_v0_ops = {
  175         .ace_mask_get = zfs_ace_v0_get_mask,
  176         .ace_mask_set = zfs_ace_v0_set_mask,
  177         .ace_flags_get = zfs_ace_v0_get_flags,
  178         .ace_flags_set = zfs_ace_v0_set_flags,
  179         .ace_type_get = zfs_ace_v0_get_type,
  180         .ace_type_set = zfs_ace_v0_set_type,
  181         .ace_who_get = zfs_ace_v0_get_who,
  182         .ace_who_set = zfs_ace_v0_set_who,
  183         .ace_size = zfs_ace_v0_size,
  184         .ace_abstract_size = zfs_ace_v0_abstract_size,
  185         .ace_mask_off = zfs_ace_v0_mask_off,
  186         .ace_data = zfs_ace_v0_data
  187 };
  188 
  189 static uint16_t
  190 zfs_ace_fuid_get_type(void *acep)
  191 {
  192         return (((zfs_ace_hdr_t *)acep)->z_type);
  193 }
  194 
  195 static uint16_t
  196 zfs_ace_fuid_get_flags(void *acep)
  197 {
  198         return (((zfs_ace_hdr_t *)acep)->z_flags);
  199 }
  200 
  201 static uint32_t
  202 zfs_ace_fuid_get_mask(void *acep)
  203 {
  204         return (((zfs_ace_hdr_t *)acep)->z_access_mask);
  205 }
  206 
  207 static uint64_t
  208 zfs_ace_fuid_get_who(void *args)
  209 {
  210         uint16_t entry_type;
  211         zfs_ace_t *acep = args;
  212 
  213         entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS;
  214 
  215         if (entry_type == ACE_OWNER || entry_type == OWNING_GROUP ||
  216             entry_type == ACE_EVERYONE)
  217                 return (-1);
  218         return (((zfs_ace_t *)acep)->z_fuid);
  219 }
  220 
  221 static void
  222 zfs_ace_fuid_set_type(void *acep, uint16_t type)
  223 {
  224         ((zfs_ace_hdr_t *)acep)->z_type = type;
  225 }
  226 
  227 static void
  228 zfs_ace_fuid_set_flags(void *acep, uint16_t flags)
  229 {
  230         ((zfs_ace_hdr_t *)acep)->z_flags = flags;
  231 }
  232 
  233 static void
  234 zfs_ace_fuid_set_mask(void *acep, uint32_t mask)
  235 {
  236         ((zfs_ace_hdr_t *)acep)->z_access_mask = mask;
  237 }
  238 
  239 static void
  240 zfs_ace_fuid_set_who(void *arg, uint64_t who)
  241 {
  242         zfs_ace_t *acep = arg;
  243 
  244         uint16_t entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS;
  245 
  246         if (entry_type == ACE_OWNER || entry_type == OWNING_GROUP ||
  247             entry_type == ACE_EVERYONE)
  248                 return;
  249         acep->z_fuid = who;
  250 }
  251 
  252 static size_t
  253 zfs_ace_fuid_size(void *acep)
  254 {
  255         zfs_ace_hdr_t *zacep = acep;
  256         uint16_t entry_type;
  257 
  258         switch (zacep->z_type) {
  259         case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
  260         case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
  261         case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
  262         case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
  263                 return (sizeof (zfs_object_ace_t));
  264         case ALLOW:
  265         case DENY:
  266                 entry_type =
  267                     (((zfs_ace_hdr_t *)acep)->z_flags & ACE_TYPE_FLAGS);
  268                 if (entry_type == ACE_OWNER ||
  269                     entry_type == OWNING_GROUP ||
  270                     entry_type == ACE_EVERYONE)
  271                         return (sizeof (zfs_ace_hdr_t));
  272                 zfs_fallthrough;
  273         default:
  274                 return (sizeof (zfs_ace_t));
  275         }
  276 }
  277 
  278 static size_t
  279 zfs_ace_fuid_abstract_size(void)
  280 {
  281         return (sizeof (zfs_ace_hdr_t));
  282 }
  283 
  284 static int
  285 zfs_ace_fuid_mask_off(void)
  286 {
  287         return (offsetof(zfs_ace_hdr_t, z_access_mask));
  288 }
  289 
  290 static int
  291 zfs_ace_fuid_data(void *acep, void **datap)
  292 {
  293         zfs_ace_t *zacep = acep;
  294         zfs_object_ace_t *zobjp;
  295 
  296         switch (zacep->z_hdr.z_type) {
  297         case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
  298         case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
  299         case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
  300         case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
  301                 zobjp = acep;
  302                 *datap = (caddr_t)zobjp + sizeof (zfs_ace_t);
  303                 return (sizeof (zfs_object_ace_t) - sizeof (zfs_ace_t));
  304         default:
  305                 *datap = NULL;
  306                 return (0);
  307         }
  308 }
  309 
  310 static const acl_ops_t zfs_acl_fuid_ops = {
  311         .ace_mask_get = zfs_ace_fuid_get_mask,
  312         .ace_mask_set = zfs_ace_fuid_set_mask,
  313         .ace_flags_get = zfs_ace_fuid_get_flags,
  314         .ace_flags_set = zfs_ace_fuid_set_flags,
  315         .ace_type_get = zfs_ace_fuid_get_type,
  316         .ace_type_set = zfs_ace_fuid_set_type,
  317         .ace_who_get = zfs_ace_fuid_get_who,
  318         .ace_who_set = zfs_ace_fuid_set_who,
  319         .ace_size = zfs_ace_fuid_size,
  320         .ace_abstract_size = zfs_ace_fuid_abstract_size,
  321         .ace_mask_off = zfs_ace_fuid_mask_off,
  322         .ace_data = zfs_ace_fuid_data
  323 };
  324 
  325 /*
  326  * The following three functions are provided for compatibility with
  327  * older ZPL version in order to determine if the file use to have
  328  * an external ACL and what version of ACL previously existed on the
  329  * file.  Would really be nice to not need this, sigh.
  330  */
  331 uint64_t
  332 zfs_external_acl(znode_t *zp)
  333 {
  334         zfs_acl_phys_t acl_phys;
  335         int error;
  336 
  337         if (zp->z_is_sa)
  338                 return (0);
  339 
  340         /*
  341          * Need to deal with a potential
  342          * race where zfs_sa_upgrade could cause
  343          * z_isa_sa to change.
  344          *
  345          * If the lookup fails then the state of z_is_sa should have
  346          * changed.
  347          */
  348 
  349         if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(ZTOZSB(zp)),
  350             &acl_phys, sizeof (acl_phys))) == 0)
  351                 return (acl_phys.z_acl_extern_obj);
  352         else {
  353                 /*
  354                  * after upgrade the SA_ZPL_ZNODE_ACL should have been
  355                  * removed
  356                  */
  357                 VERIFY(zp->z_is_sa && error == ENOENT);
  358                 return (0);
  359         }
  360 }
  361 
  362 /*
  363  * Determine size of ACL in bytes
  364  *
  365  * This is more complicated than it should be since we have to deal
  366  * with old external ACLs.
  367  */
  368 static int
  369 zfs_acl_znode_info(znode_t *zp, int *aclsize, int *aclcount,
  370     zfs_acl_phys_t *aclphys)
  371 {
  372         zfsvfs_t *zfsvfs = ZTOZSB(zp);
  373         uint64_t acl_count;
  374         int size;
  375         int error;
  376 
  377         ASSERT(MUTEX_HELD(&zp->z_acl_lock));
  378         if (zp->z_is_sa) {
  379                 if ((error = sa_size(zp->z_sa_hdl, SA_ZPL_DACL_ACES(zfsvfs),
  380                     &size)) != 0)
  381                         return (error);
  382                 *aclsize = size;
  383                 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_DACL_COUNT(zfsvfs),
  384                     &acl_count, sizeof (acl_count))) != 0)
  385                         return (error);
  386                 *aclcount = acl_count;
  387         } else {
  388                 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zfsvfs),
  389                     aclphys, sizeof (*aclphys))) != 0)
  390                         return (error);
  391 
  392                 if (aclphys->z_acl_version == ZFS_ACL_VERSION_INITIAL) {
  393                         *aclsize = ZFS_ACL_SIZE(aclphys->z_acl_size);
  394                         *aclcount = aclphys->z_acl_size;
  395                 } else {
  396                         *aclsize = aclphys->z_acl_size;
  397                         *aclcount = aclphys->z_acl_count;
  398                 }
  399         }
  400         return (0);
  401 }
  402 
  403 int
  404 zfs_znode_acl_version(znode_t *zp)
  405 {
  406         zfs_acl_phys_t acl_phys;
  407 
  408         if (zp->z_is_sa)
  409                 return (ZFS_ACL_VERSION_FUID);
  410         else {
  411                 int error;
  412 
  413                 /*
  414                  * Need to deal with a potential
  415                  * race where zfs_sa_upgrade could cause
  416                  * z_isa_sa to change.
  417                  *
  418                  * If the lookup fails then the state of z_is_sa should have
  419                  * changed.
  420                  */
  421                 if ((error = sa_lookup(zp->z_sa_hdl,
  422                     SA_ZPL_ZNODE_ACL(ZTOZSB(zp)),
  423                     &acl_phys, sizeof (acl_phys))) == 0)
  424                         return (acl_phys.z_acl_version);
  425                 else {
  426                         /*
  427                          * After upgrade SA_ZPL_ZNODE_ACL should have
  428                          * been removed.
  429                          */
  430                         VERIFY(zp->z_is_sa && error == ENOENT);
  431                         return (ZFS_ACL_VERSION_FUID);
  432                 }
  433         }
  434 }
  435 
  436 static int
  437 zfs_acl_version(int version)
  438 {
  439         if (version < ZPL_VERSION_FUID)
  440                 return (ZFS_ACL_VERSION_INITIAL);
  441         else
  442                 return (ZFS_ACL_VERSION_FUID);
  443 }
  444 
  445 static int
  446 zfs_acl_version_zp(znode_t *zp)
  447 {
  448         return (zfs_acl_version(ZTOZSB(zp)->z_version));
  449 }
  450 
  451 zfs_acl_t *
  452 zfs_acl_alloc(int vers)
  453 {
  454         zfs_acl_t *aclp;
  455 
  456         aclp = kmem_zalloc(sizeof (zfs_acl_t), KM_SLEEP);
  457         list_create(&aclp->z_acl, sizeof (zfs_acl_node_t),
  458             offsetof(zfs_acl_node_t, z_next));
  459         aclp->z_version = vers;
  460         if (vers == ZFS_ACL_VERSION_FUID)
  461                 aclp->z_ops = &zfs_acl_fuid_ops;
  462         else
  463                 aclp->z_ops = &zfs_acl_v0_ops;
  464         return (aclp);
  465 }
  466 
  467 zfs_acl_node_t *
  468 zfs_acl_node_alloc(size_t bytes)
  469 {
  470         zfs_acl_node_t *aclnode;
  471 
  472         aclnode = kmem_zalloc(sizeof (zfs_acl_node_t), KM_SLEEP);
  473         if (bytes) {
  474                 aclnode->z_acldata = kmem_alloc(bytes, KM_SLEEP);
  475                 aclnode->z_allocdata = aclnode->z_acldata;
  476                 aclnode->z_allocsize = bytes;
  477                 aclnode->z_size = bytes;
  478         }
  479 
  480         return (aclnode);
  481 }
  482 
  483 static void
  484 zfs_acl_node_free(zfs_acl_node_t *aclnode)
  485 {
  486         if (aclnode->z_allocsize)
  487                 kmem_free(aclnode->z_allocdata, aclnode->z_allocsize);
  488         kmem_free(aclnode, sizeof (zfs_acl_node_t));
  489 }
  490 
  491 static void
  492 zfs_acl_release_nodes(zfs_acl_t *aclp)
  493 {
  494         zfs_acl_node_t *aclnode;
  495 
  496         while ((aclnode = list_head(&aclp->z_acl))) {
  497                 list_remove(&aclp->z_acl, aclnode);
  498                 zfs_acl_node_free(aclnode);
  499         }
  500         aclp->z_acl_count = 0;
  501         aclp->z_acl_bytes = 0;
  502 }
  503 
  504 void
  505 zfs_acl_free(zfs_acl_t *aclp)
  506 {
  507         zfs_acl_release_nodes(aclp);
  508         list_destroy(&aclp->z_acl);
  509         kmem_free(aclp, sizeof (zfs_acl_t));
  510 }
  511 
  512 static boolean_t
  513 zfs_acl_valid_ace_type(uint_t type, uint_t flags)
  514 {
  515         uint16_t entry_type;
  516 
  517         switch (type) {
  518         case ALLOW:
  519         case DENY:
  520         case ACE_SYSTEM_AUDIT_ACE_TYPE:
  521         case ACE_SYSTEM_ALARM_ACE_TYPE:
  522                 entry_type = flags & ACE_TYPE_FLAGS;
  523                 return (entry_type == ACE_OWNER ||
  524                     entry_type == OWNING_GROUP ||
  525                     entry_type == ACE_EVERYONE || entry_type == 0 ||
  526                     entry_type == ACE_IDENTIFIER_GROUP);
  527         default:
  528                 if (type <= MAX_ACE_TYPE)
  529                         return (B_TRUE);
  530         }
  531         return (B_FALSE);
  532 }
  533 
  534 static boolean_t
  535 zfs_ace_valid(umode_t obj_mode, zfs_acl_t *aclp, uint16_t type, uint16_t iflags)
  536 {
  537         /*
  538          * first check type of entry
  539          */
  540 
  541         if (!zfs_acl_valid_ace_type(type, iflags))
  542                 return (B_FALSE);
  543 
  544         switch (type) {
  545         case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
  546         case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
  547         case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
  548         case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
  549                 if (aclp->z_version < ZFS_ACL_VERSION_FUID)
  550                         return (B_FALSE);
  551                 aclp->z_hints |= ZFS_ACL_OBJ_ACE;
  552         }
  553 
  554         /*
  555          * next check inheritance level flags
  556          */
  557 
  558         if (S_ISDIR(obj_mode) &&
  559             (iflags & (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE)))
  560                 aclp->z_hints |= ZFS_INHERIT_ACE;
  561 
  562         if (iflags & (ACE_INHERIT_ONLY_ACE|ACE_NO_PROPAGATE_INHERIT_ACE)) {
  563                 if ((iflags & (ACE_FILE_INHERIT_ACE|
  564                     ACE_DIRECTORY_INHERIT_ACE)) == 0) {
  565                         return (B_FALSE);
  566                 }
  567         }
  568 
  569         return (B_TRUE);
  570 }
  571 
  572 static void *
  573 zfs_acl_next_ace(zfs_acl_t *aclp, void *start, uint64_t *who,
  574     uint32_t *access_mask, uint16_t *iflags, uint16_t *type)
  575 {
  576         zfs_acl_node_t *aclnode;
  577 
  578         ASSERT(aclp);
  579 
  580         if (start == NULL) {
  581                 aclnode = list_head(&aclp->z_acl);
  582                 if (aclnode == NULL)
  583                         return (NULL);
  584 
  585                 aclp->z_next_ace = aclnode->z_acldata;
  586                 aclp->z_curr_node = aclnode;
  587                 aclnode->z_ace_idx = 0;
  588         }
  589 
  590         aclnode = aclp->z_curr_node;
  591 
  592         if (aclnode == NULL)
  593                 return (NULL);
  594 
  595         if (aclnode->z_ace_idx >= aclnode->z_ace_count) {
  596                 aclnode = list_next(&aclp->z_acl, aclnode);
  597                 if (aclnode == NULL)
  598                         return (NULL);
  599                 else {
  600                         aclp->z_curr_node = aclnode;
  601                         aclnode->z_ace_idx = 0;
  602                         aclp->z_next_ace = aclnode->z_acldata;
  603                 }
  604         }
  605 
  606         if (aclnode->z_ace_idx < aclnode->z_ace_count) {
  607                 void *acep = aclp->z_next_ace;
  608                 size_t ace_size;
  609 
  610                 /*
  611                  * Make sure we don't overstep our bounds
  612                  */
  613                 ace_size = aclp->z_ops->ace_size(acep);
  614 
  615                 if (((caddr_t)acep + ace_size) >
  616                     ((caddr_t)aclnode->z_acldata + aclnode->z_size)) {
  617                         return (NULL);
  618                 }
  619 
  620                 *iflags = aclp->z_ops->ace_flags_get(acep);
  621                 *type = aclp->z_ops->ace_type_get(acep);
  622                 *access_mask = aclp->z_ops->ace_mask_get(acep);
  623                 *who = aclp->z_ops->ace_who_get(acep);
  624                 aclp->z_next_ace = (caddr_t)aclp->z_next_ace + ace_size;
  625                 aclnode->z_ace_idx++;
  626 
  627                 return ((void *)acep);
  628         }
  629         return (NULL);
  630 }
  631 
  632 static uintptr_t
  633 zfs_ace_walk(void *datap, uintptr_t cookie, int aclcnt,
  634     uint16_t *flags, uint16_t *type, uint32_t *mask)
  635 {
  636         (void) aclcnt;
  637         zfs_acl_t *aclp = datap;
  638         zfs_ace_hdr_t *acep = (zfs_ace_hdr_t *)cookie;
  639         uint64_t who;
  640 
  641         acep = zfs_acl_next_ace(aclp, acep, &who, mask,
  642             flags, type);
  643         return ((uintptr_t)acep);
  644 }
  645 
  646 /*
  647  * Copy ACE to internal ZFS format.
  648  * While processing the ACL each ACE will be validated for correctness.
  649  * ACE FUIDs will be created later.
  650  */
  651 static int
  652 zfs_copy_ace_2_fuid(zfsvfs_t *zfsvfs, umode_t obj_mode, zfs_acl_t *aclp,
  653     void *datap, zfs_ace_t *z_acl, uint64_t aclcnt, size_t *size,
  654     zfs_fuid_info_t **fuidp, cred_t *cr)
  655 {
  656         int i;
  657         uint16_t entry_type;
  658         zfs_ace_t *aceptr = z_acl;
  659         ace_t *acep = datap;
  660         zfs_object_ace_t *zobjacep;
  661         ace_object_t *aceobjp;
  662 
  663         for (i = 0; i != aclcnt; i++) {
  664                 aceptr->z_hdr.z_access_mask = acep->a_access_mask;
  665                 aceptr->z_hdr.z_flags = acep->a_flags;
  666                 aceptr->z_hdr.z_type = acep->a_type;
  667                 entry_type = aceptr->z_hdr.z_flags & ACE_TYPE_FLAGS;
  668                 if (entry_type != ACE_OWNER && entry_type != OWNING_GROUP &&
  669                     entry_type != ACE_EVERYONE) {
  670                         aceptr->z_fuid = zfs_fuid_create(zfsvfs, acep->a_who,
  671                             cr, (entry_type == 0) ?
  672                             ZFS_ACE_USER : ZFS_ACE_GROUP, fuidp);
  673                 }
  674 
  675                 /*
  676                  * Make sure ACE is valid
  677                  */
  678                 if (zfs_ace_valid(obj_mode, aclp, aceptr->z_hdr.z_type,
  679                     aceptr->z_hdr.z_flags) != B_TRUE)
  680                         return (SET_ERROR(EINVAL));
  681 
  682                 switch (acep->a_type) {
  683                 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
  684                 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
  685                 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
  686                 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
  687                         zobjacep = (zfs_object_ace_t *)aceptr;
  688                         aceobjp = (ace_object_t *)acep;
  689 
  690                         memcpy(zobjacep->z_object_type, aceobjp->a_obj_type,
  691                             sizeof (aceobjp->a_obj_type));
  692                         memcpy(zobjacep->z_inherit_type,
  693                             aceobjp->a_inherit_obj_type,
  694                             sizeof (aceobjp->a_inherit_obj_type));
  695                         acep = (ace_t *)((caddr_t)acep + sizeof (ace_object_t));
  696                         break;
  697                 default:
  698                         acep = (ace_t *)((caddr_t)acep + sizeof (ace_t));
  699                 }
  700 
  701                 aceptr = (zfs_ace_t *)((caddr_t)aceptr +
  702                     aclp->z_ops->ace_size(aceptr));
  703         }
  704 
  705         *size = (caddr_t)aceptr - (caddr_t)z_acl;
  706 
  707         return (0);
  708 }
  709 
  710 /*
  711  * Copy ZFS ACEs to fixed size ace_t layout
  712  */
  713 static void
  714 zfs_copy_fuid_2_ace(zfsvfs_t *zfsvfs, zfs_acl_t *aclp, cred_t *cr,
  715     void *datap, int filter)
  716 {
  717         uint64_t who;
  718         uint32_t access_mask;
  719         uint16_t iflags, type;
  720         zfs_ace_hdr_t *zacep = NULL;
  721         ace_t *acep = datap;
  722         ace_object_t *objacep;
  723         zfs_object_ace_t *zobjacep;
  724         size_t ace_size;
  725         uint16_t entry_type;
  726 
  727         while ((zacep = zfs_acl_next_ace(aclp, zacep,
  728             &who, &access_mask, &iflags, &type))) {
  729 
  730                 switch (type) {
  731                 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
  732                 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
  733                 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
  734                 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
  735                         if (filter) {
  736                                 continue;
  737                         }
  738                         zobjacep = (zfs_object_ace_t *)zacep;
  739                         objacep = (ace_object_t *)acep;
  740                         memcpy(objacep->a_obj_type,
  741                             zobjacep->z_object_type,
  742                             sizeof (zobjacep->z_object_type));
  743                         memcpy(objacep->a_inherit_obj_type,
  744                             zobjacep->z_inherit_type,
  745                             sizeof (zobjacep->z_inherit_type));
  746                         ace_size = sizeof (ace_object_t);
  747                         break;
  748                 default:
  749                         ace_size = sizeof (ace_t);
  750                         break;
  751                 }
  752 
  753                 entry_type = (iflags & ACE_TYPE_FLAGS);
  754                 if ((entry_type != ACE_OWNER &&
  755                     entry_type != OWNING_GROUP &&
  756                     entry_type != ACE_EVERYONE)) {
  757                         acep->a_who = zfs_fuid_map_id(zfsvfs, who,
  758                             cr, (entry_type & ACE_IDENTIFIER_GROUP) ?
  759                             ZFS_ACE_GROUP : ZFS_ACE_USER);
  760                 } else {
  761                         acep->a_who = (uid_t)(int64_t)who;
  762                 }
  763                 acep->a_access_mask = access_mask;
  764                 acep->a_flags = iflags;
  765                 acep->a_type = type;
  766                 acep = (ace_t *)((caddr_t)acep + ace_size);
  767         }
  768 }
  769 
  770 static int
  771 zfs_copy_ace_2_oldace(umode_t obj_mode, zfs_acl_t *aclp, ace_t *acep,
  772     zfs_oldace_t *z_acl, int aclcnt, size_t *size)
  773 {
  774         int i;
  775         zfs_oldace_t *aceptr = z_acl;
  776 
  777         for (i = 0; i != aclcnt; i++, aceptr++) {
  778                 aceptr->z_access_mask = acep[i].a_access_mask;
  779                 aceptr->z_type = acep[i].a_type;
  780                 aceptr->z_flags = acep[i].a_flags;
  781                 aceptr->z_fuid = acep[i].a_who;
  782                 /*
  783                  * Make sure ACE is valid
  784                  */
  785                 if (zfs_ace_valid(obj_mode, aclp, aceptr->z_type,
  786                     aceptr->z_flags) != B_TRUE)
  787                         return (SET_ERROR(EINVAL));
  788         }
  789         *size = (caddr_t)aceptr - (caddr_t)z_acl;
  790         return (0);
  791 }
  792 
  793 /*
  794  * convert old ACL format to new
  795  */
  796 void
  797 zfs_acl_xform(znode_t *zp, zfs_acl_t *aclp, cred_t *cr)
  798 {
  799         zfs_oldace_t *oldaclp;
  800         int i;
  801         uint16_t type, iflags;
  802         uint32_t access_mask;
  803         uint64_t who;
  804         void *cookie = NULL;
  805         zfs_acl_node_t *newaclnode;
  806 
  807         ASSERT(aclp->z_version == ZFS_ACL_VERSION_INITIAL);
  808         /*
  809          * First create the ACE in a contiguous piece of memory
  810          * for zfs_copy_ace_2_fuid().
  811          *
  812          * We only convert an ACL once, so this won't happen
  813          * every time.
  814          */
  815         oldaclp = kmem_alloc(sizeof (zfs_oldace_t) * aclp->z_acl_count,
  816             KM_SLEEP);
  817         i = 0;
  818         while ((cookie = zfs_acl_next_ace(aclp, cookie, &who,
  819             &access_mask, &iflags, &type))) {
  820                 oldaclp[i].z_flags = iflags;
  821                 oldaclp[i].z_type = type;
  822                 oldaclp[i].z_fuid = who;
  823                 oldaclp[i++].z_access_mask = access_mask;
  824         }
  825 
  826         newaclnode = zfs_acl_node_alloc(aclp->z_acl_count *
  827             sizeof (zfs_object_ace_t));
  828         aclp->z_ops = &zfs_acl_fuid_ops;
  829         VERIFY(zfs_copy_ace_2_fuid(ZTOZSB(zp), ZTOI(zp)->i_mode,
  830             aclp, oldaclp, newaclnode->z_acldata, aclp->z_acl_count,
  831             &newaclnode->z_size, NULL, cr) == 0);
  832         newaclnode->z_ace_count = aclp->z_acl_count;
  833         aclp->z_version = ZFS_ACL_VERSION;
  834         kmem_free(oldaclp, aclp->z_acl_count * sizeof (zfs_oldace_t));
  835 
  836         /*
  837          * Release all previous ACL nodes
  838          */
  839 
  840         zfs_acl_release_nodes(aclp);
  841 
  842         list_insert_head(&aclp->z_acl, newaclnode);
  843 
  844         aclp->z_acl_bytes = newaclnode->z_size;
  845         aclp->z_acl_count = newaclnode->z_ace_count;
  846 
  847 }
  848 
  849 /*
  850  * Convert unix access mask to v4 access mask
  851  */
  852 static uint32_t
  853 zfs_unix_to_v4(uint32_t access_mask)
  854 {
  855         uint32_t new_mask = 0;
  856 
  857         if (access_mask & S_IXOTH)
  858                 new_mask |= ACE_EXECUTE;
  859         if (access_mask & S_IWOTH)
  860                 new_mask |= ACE_WRITE_DATA;
  861         if (access_mask & S_IROTH)
  862                 new_mask |= ACE_READ_DATA;
  863         return (new_mask);
  864 }
  865 
  866 
  867 static int
  868 zfs_v4_to_unix(uint32_t access_mask, int *unmapped)
  869 {
  870         int new_mask = 0;
  871 
  872         *unmapped = access_mask &
  873             (ACE_WRITE_OWNER | ACE_WRITE_ACL | ACE_DELETE);
  874 
  875         if (access_mask & WRITE_MASK)
  876                 new_mask |= S_IWOTH;
  877         if (access_mask & ACE_READ_DATA)
  878                 new_mask |= S_IROTH;
  879         if (access_mask & ACE_EXECUTE)
  880                 new_mask |= S_IXOTH;
  881 
  882         return (new_mask);
  883 }
  884 
  885 
  886 static void
  887 zfs_set_ace(zfs_acl_t *aclp, void *acep, uint32_t access_mask,
  888     uint16_t access_type, uint64_t fuid, uint16_t entry_type)
  889 {
  890         uint16_t type = entry_type & ACE_TYPE_FLAGS;
  891 
  892         aclp->z_ops->ace_mask_set(acep, access_mask);
  893         aclp->z_ops->ace_type_set(acep, access_type);
  894         aclp->z_ops->ace_flags_set(acep, entry_type);
  895         if ((type != ACE_OWNER && type != OWNING_GROUP &&
  896             type != ACE_EVERYONE))
  897                 aclp->z_ops->ace_who_set(acep, fuid);
  898 }
  899 
  900 /*
  901  * Determine mode of file based on ACL.
  902  */
  903 uint64_t
  904 zfs_mode_compute(uint64_t fmode, zfs_acl_t *aclp,
  905     uint64_t *pflags, uint64_t fuid, uint64_t fgid)
  906 {
  907         int             entry_type;
  908         mode_t          mode;
  909         mode_t          seen = 0;
  910         zfs_ace_hdr_t   *acep = NULL;
  911         uint64_t        who;
  912         uint16_t        iflags, type;
  913         uint32_t        access_mask;
  914         boolean_t       an_exec_denied = B_FALSE;
  915 
  916         mode = (fmode & (S_IFMT | S_ISUID | S_ISGID | S_ISVTX));
  917 
  918         while ((acep = zfs_acl_next_ace(aclp, acep, &who,
  919             &access_mask, &iflags, &type))) {
  920 
  921                 if (!zfs_acl_valid_ace_type(type, iflags))
  922                         continue;
  923 
  924                 entry_type = (iflags & ACE_TYPE_FLAGS);
  925 
  926                 /*
  927                  * Skip over any inherit_only ACEs
  928                  */
  929                 if (iflags & ACE_INHERIT_ONLY_ACE)
  930                         continue;
  931 
  932                 if (entry_type == ACE_OWNER || (entry_type == 0 &&
  933                     who == fuid)) {
  934                         if ((access_mask & ACE_READ_DATA) &&
  935                             (!(seen & S_IRUSR))) {
  936                                 seen |= S_IRUSR;
  937                                 if (type == ALLOW) {
  938                                         mode |= S_IRUSR;
  939                                 }
  940                         }
  941                         if ((access_mask & ACE_WRITE_DATA) &&
  942                             (!(seen & S_IWUSR))) {
  943                                 seen |= S_IWUSR;
  944                                 if (type == ALLOW) {
  945                                         mode |= S_IWUSR;
  946                                 }
  947                         }
  948                         if ((access_mask & ACE_EXECUTE) &&
  949                             (!(seen & S_IXUSR))) {
  950                                 seen |= S_IXUSR;
  951                                 if (type == ALLOW) {
  952                                         mode |= S_IXUSR;
  953                                 }
  954                         }
  955                 } else if (entry_type == OWNING_GROUP ||
  956                     (entry_type == ACE_IDENTIFIER_GROUP && who == fgid)) {
  957                         if ((access_mask & ACE_READ_DATA) &&
  958                             (!(seen & S_IRGRP))) {
  959                                 seen |= S_IRGRP;
  960                                 if (type == ALLOW) {
  961                                         mode |= S_IRGRP;
  962                                 }
  963                         }
  964                         if ((access_mask & ACE_WRITE_DATA) &&
  965                             (!(seen & S_IWGRP))) {
  966                                 seen |= S_IWGRP;
  967                                 if (type == ALLOW) {
  968                                         mode |= S_IWGRP;
  969                                 }
  970                         }
  971                         if ((access_mask & ACE_EXECUTE) &&
  972                             (!(seen & S_IXGRP))) {
  973                                 seen |= S_IXGRP;
  974                                 if (type == ALLOW) {
  975                                         mode |= S_IXGRP;
  976                                 }
  977                         }
  978                 } else if (entry_type == ACE_EVERYONE) {
  979                         if ((access_mask & ACE_READ_DATA)) {
  980                                 if (!(seen & S_IRUSR)) {
  981                                         seen |= S_IRUSR;
  982                                         if (type == ALLOW) {
  983                                                 mode |= S_IRUSR;
  984                                         }
  985                                 }
  986                                 if (!(seen & S_IRGRP)) {
  987                                         seen |= S_IRGRP;
  988                                         if (type == ALLOW) {
  989                                                 mode |= S_IRGRP;
  990                                         }
  991                                 }
  992                                 if (!(seen & S_IROTH)) {
  993                                         seen |= S_IROTH;
  994                                         if (type == ALLOW) {
  995                                                 mode |= S_IROTH;
  996                                         }
  997                                 }
  998                         }
  999                         if ((access_mask & ACE_WRITE_DATA)) {
 1000                                 if (!(seen & S_IWUSR)) {
 1001                                         seen |= S_IWUSR;
 1002                                         if (type == ALLOW) {
 1003                                                 mode |= S_IWUSR;
 1004                                         }
 1005                                 }
 1006                                 if (!(seen & S_IWGRP)) {
 1007                                         seen |= S_IWGRP;
 1008                                         if (type == ALLOW) {
 1009                                                 mode |= S_IWGRP;
 1010                                         }
 1011                                 }
 1012                                 if (!(seen & S_IWOTH)) {
 1013                                         seen |= S_IWOTH;
 1014                                         if (type == ALLOW) {
 1015                                                 mode |= S_IWOTH;
 1016                                         }
 1017                                 }
 1018                         }
 1019                         if ((access_mask & ACE_EXECUTE)) {
 1020                                 if (!(seen & S_IXUSR)) {
 1021                                         seen |= S_IXUSR;
 1022                                         if (type == ALLOW) {
 1023                                                 mode |= S_IXUSR;
 1024                                         }
 1025                                 }
 1026                                 if (!(seen & S_IXGRP)) {
 1027                                         seen |= S_IXGRP;
 1028                                         if (type == ALLOW) {
 1029                                                 mode |= S_IXGRP;
 1030                                         }
 1031                                 }
 1032                                 if (!(seen & S_IXOTH)) {
 1033                                         seen |= S_IXOTH;
 1034                                         if (type == ALLOW) {
 1035                                                 mode |= S_IXOTH;
 1036                                         }
 1037                                 }
 1038                         }
 1039                 } else {
 1040                         /*
 1041                          * Only care if this IDENTIFIER_GROUP or
 1042                          * USER ACE denies execute access to someone,
 1043                          * mode is not affected
 1044                          */
 1045                         if ((access_mask & ACE_EXECUTE) && type == DENY)
 1046                                 an_exec_denied = B_TRUE;
 1047                 }
 1048         }
 1049 
 1050         /*
 1051          * Failure to allow is effectively a deny, so execute permission
 1052          * is denied if it was never mentioned or if we explicitly
 1053          * weren't allowed it.
 1054          */
 1055         if (!an_exec_denied &&
 1056             ((seen & ALL_MODE_EXECS) != ALL_MODE_EXECS ||
 1057             (mode & ALL_MODE_EXECS) != ALL_MODE_EXECS))
 1058                 an_exec_denied = B_TRUE;
 1059 
 1060         if (an_exec_denied)
 1061                 *pflags &= ~ZFS_NO_EXECS_DENIED;
 1062         else
 1063                 *pflags |= ZFS_NO_EXECS_DENIED;
 1064 
 1065         return (mode);
 1066 }
 1067 
 1068 /*
 1069  * Read an external acl object.  If the intent is to modify, always
 1070  * create a new acl and leave any cached acl in place.
 1071  */
 1072 int
 1073 zfs_acl_node_read(struct znode *zp, boolean_t have_lock, zfs_acl_t **aclpp,
 1074     boolean_t will_modify)
 1075 {
 1076         zfs_acl_t       *aclp;
 1077         int             aclsize = 0;
 1078         int             acl_count = 0;
 1079         zfs_acl_node_t  *aclnode;
 1080         zfs_acl_phys_t  znode_acl;
 1081         int             version;
 1082         int             error;
 1083         boolean_t       drop_lock = B_FALSE;
 1084 
 1085         ASSERT(MUTEX_HELD(&zp->z_acl_lock));
 1086 
 1087         if (zp->z_acl_cached && !will_modify) {
 1088                 *aclpp = zp->z_acl_cached;
 1089                 return (0);
 1090         }
 1091 
 1092         /*
 1093          * close race where znode could be upgrade while trying to
 1094          * read the znode attributes.
 1095          *
 1096          * But this could only happen if the file isn't already an SA
 1097          * znode
 1098          */
 1099         if (!zp->z_is_sa && !have_lock) {
 1100                 mutex_enter(&zp->z_lock);
 1101                 drop_lock = B_TRUE;
 1102         }
 1103         version = zfs_znode_acl_version(zp);
 1104 
 1105         if ((error = zfs_acl_znode_info(zp, &aclsize,
 1106             &acl_count, &znode_acl)) != 0) {
 1107                 goto done;
 1108         }
 1109 
 1110         aclp = zfs_acl_alloc(version);
 1111 
 1112         aclp->z_acl_count = acl_count;
 1113         aclp->z_acl_bytes = aclsize;
 1114 
 1115         aclnode = zfs_acl_node_alloc(aclsize);
 1116         aclnode->z_ace_count = aclp->z_acl_count;
 1117         aclnode->z_size = aclsize;
 1118 
 1119         if (!zp->z_is_sa) {
 1120                 if (znode_acl.z_acl_extern_obj) {
 1121                         error = dmu_read(ZTOZSB(zp)->z_os,
 1122                             znode_acl.z_acl_extern_obj, 0, aclnode->z_size,
 1123                             aclnode->z_acldata, DMU_READ_PREFETCH);
 1124                 } else {
 1125                         memcpy(aclnode->z_acldata, znode_acl.z_ace_data,
 1126                             aclnode->z_size);
 1127                 }
 1128         } else {
 1129                 error = sa_lookup(zp->z_sa_hdl, SA_ZPL_DACL_ACES(ZTOZSB(zp)),
 1130                     aclnode->z_acldata, aclnode->z_size);
 1131         }
 1132 
 1133         if (error != 0) {
 1134                 zfs_acl_free(aclp);
 1135                 zfs_acl_node_free(aclnode);
 1136                 /* convert checksum errors into IO errors */
 1137                 if (error == ECKSUM)
 1138                         error = SET_ERROR(EIO);
 1139                 goto done;
 1140         }
 1141 
 1142         list_insert_head(&aclp->z_acl, aclnode);
 1143 
 1144         *aclpp = aclp;
 1145         if (!will_modify)
 1146                 zp->z_acl_cached = aclp;
 1147 done:
 1148         if (drop_lock)
 1149                 mutex_exit(&zp->z_lock);
 1150         return (error);
 1151 }
 1152 
 1153 void
 1154 zfs_acl_data_locator(void **dataptr, uint32_t *length, uint32_t buflen,
 1155     boolean_t start, void *userdata)
 1156 {
 1157         (void) buflen;
 1158         zfs_acl_locator_cb_t *cb = (zfs_acl_locator_cb_t *)userdata;
 1159 
 1160         if (start) {
 1161                 cb->cb_acl_node = list_head(&cb->cb_aclp->z_acl);
 1162         } else {
 1163                 cb->cb_acl_node = list_next(&cb->cb_aclp->z_acl,
 1164                     cb->cb_acl_node);
 1165         }
 1166         ASSERT3P(cb->cb_acl_node, !=, NULL);
 1167         *dataptr = cb->cb_acl_node->z_acldata;
 1168         *length = cb->cb_acl_node->z_size;
 1169 }
 1170 
 1171 int
 1172 zfs_acl_chown_setattr(znode_t *zp)
 1173 {
 1174         int error;
 1175         zfs_acl_t *aclp;
 1176 
 1177         if (ZTOZSB(zp)->z_acl_type == ZFS_ACLTYPE_POSIX)
 1178                 return (0);
 1179 
 1180         ASSERT(MUTEX_HELD(&zp->z_lock));
 1181         ASSERT(MUTEX_HELD(&zp->z_acl_lock));
 1182 
 1183         error = zfs_acl_node_read(zp, B_TRUE, &aclp, B_FALSE);
 1184         if (error == 0 && aclp->z_acl_count > 0)
 1185                 zp->z_mode = ZTOI(zp)->i_mode =
 1186                     zfs_mode_compute(zp->z_mode, aclp,
 1187                     &zp->z_pflags, KUID_TO_SUID(ZTOI(zp)->i_uid),
 1188                     KGID_TO_SGID(ZTOI(zp)->i_gid));
 1189 
 1190         /*
 1191          * Some ZFS implementations (ZEVO) create neither a ZNODE_ACL
 1192          * nor a DACL_ACES SA in which case ENOENT is returned from
 1193          * zfs_acl_node_read() when the SA can't be located.
 1194          * Allow chown/chgrp to succeed in these cases rather than
 1195          * returning an error that makes no sense in the context of
 1196          * the caller.
 1197          */
 1198         if (error == ENOENT)
 1199                 return (0);
 1200 
 1201         return (error);
 1202 }
 1203 
 1204 typedef struct trivial_acl {
 1205         uint32_t        allow0;         /* allow mask for bits only in owner */
 1206         uint32_t        deny1;          /* deny mask for bits not in owner */
 1207         uint32_t        deny2;          /* deny mask for bits not in group */
 1208         uint32_t        owner;          /* allow mask matching mode */
 1209         uint32_t        group;          /* allow mask matching mode */
 1210         uint32_t        everyone;       /* allow mask matching mode */
 1211 } trivial_acl_t;
 1212 
 1213 static void
 1214 acl_trivial_access_masks(mode_t mode, boolean_t isdir, trivial_acl_t *masks)
 1215 {
 1216         uint32_t read_mask = ACE_READ_DATA;
 1217         uint32_t write_mask = ACE_WRITE_DATA|ACE_APPEND_DATA;
 1218         uint32_t execute_mask = ACE_EXECUTE;
 1219 
 1220         if (isdir)
 1221                 write_mask |= ACE_DELETE_CHILD;
 1222 
 1223         masks->deny1 = 0;
 1224 
 1225         if (!(mode & S_IRUSR) && (mode & (S_IRGRP|S_IROTH)))
 1226                 masks->deny1 |= read_mask;
 1227         if (!(mode & S_IWUSR) && (mode & (S_IWGRP|S_IWOTH)))
 1228                 masks->deny1 |= write_mask;
 1229         if (!(mode & S_IXUSR) && (mode & (S_IXGRP|S_IXOTH)))
 1230                 masks->deny1 |= execute_mask;
 1231 
 1232         masks->deny2 = 0;
 1233         if (!(mode & S_IRGRP) && (mode & S_IROTH))
 1234                 masks->deny2 |= read_mask;
 1235         if (!(mode & S_IWGRP) && (mode & S_IWOTH))
 1236                 masks->deny2 |= write_mask;
 1237         if (!(mode & S_IXGRP) && (mode & S_IXOTH))
 1238                 masks->deny2 |= execute_mask;
 1239 
 1240         masks->allow0 = 0;
 1241         if ((mode & S_IRUSR) && (!(mode & S_IRGRP) && (mode & S_IROTH)))
 1242                 masks->allow0 |= read_mask;
 1243         if ((mode & S_IWUSR) && (!(mode & S_IWGRP) && (mode & S_IWOTH)))
 1244                 masks->allow0 |= write_mask;
 1245         if ((mode & S_IXUSR) && (!(mode & S_IXGRP) && (mode & S_IXOTH)))
 1246                 masks->allow0 |= execute_mask;
 1247 
 1248         masks->owner = ACE_WRITE_ATTRIBUTES|ACE_WRITE_OWNER|ACE_WRITE_ACL|
 1249             ACE_WRITE_NAMED_ATTRS|ACE_READ_ACL|ACE_READ_ATTRIBUTES|
 1250             ACE_READ_NAMED_ATTRS|ACE_SYNCHRONIZE;
 1251         if (mode & S_IRUSR)
 1252                 masks->owner |= read_mask;
 1253         if (mode & S_IWUSR)
 1254                 masks->owner |= write_mask;
 1255         if (mode & S_IXUSR)
 1256                 masks->owner |= execute_mask;
 1257 
 1258         masks->group = ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_READ_NAMED_ATTRS|
 1259             ACE_SYNCHRONIZE;
 1260         if (mode & S_IRGRP)
 1261                 masks->group |= read_mask;
 1262         if (mode & S_IWGRP)
 1263                 masks->group |= write_mask;
 1264         if (mode & S_IXGRP)
 1265                 masks->group |= execute_mask;
 1266 
 1267         masks->everyone = ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_READ_NAMED_ATTRS|
 1268             ACE_SYNCHRONIZE;
 1269         if (mode & S_IROTH)
 1270                 masks->everyone |= read_mask;
 1271         if (mode & S_IWOTH)
 1272                 masks->everyone |= write_mask;
 1273         if (mode & S_IXOTH)
 1274                 masks->everyone |= execute_mask;
 1275 }
 1276 
 1277 /*
 1278  * ace_trivial:
 1279  * determine whether an ace_t acl is trivial
 1280  *
 1281  * Trivialness implies that the acl is composed of only
 1282  * owner, group, everyone entries.  ACL can't
 1283  * have read_acl denied, and write_owner/write_acl/write_attributes
 1284  * can only be owner@ entry.
 1285  */
 1286 static int
 1287 ace_trivial_common(void *acep, int aclcnt,
 1288     uintptr_t (*walk)(void *, uintptr_t, int,
 1289     uint16_t *, uint16_t *, uint32_t *))
 1290 {
 1291         uint16_t flags;
 1292         uint32_t mask;
 1293         uint16_t type;
 1294         uint64_t cookie = 0;
 1295 
 1296         while ((cookie = walk(acep, cookie, aclcnt, &flags, &type, &mask))) {
 1297                 switch (flags & ACE_TYPE_FLAGS) {
 1298                 case ACE_OWNER:
 1299                 case ACE_GROUP|ACE_IDENTIFIER_GROUP:
 1300                 case ACE_EVERYONE:
 1301                         break;
 1302                 default:
 1303                         return (1);
 1304                 }
 1305 
 1306                 if (flags & (ACE_FILE_INHERIT_ACE|
 1307                     ACE_DIRECTORY_INHERIT_ACE|ACE_NO_PROPAGATE_INHERIT_ACE|
 1308                     ACE_INHERIT_ONLY_ACE))
 1309                         return (1);
 1310 
 1311                 /*
 1312                  * Special check for some special bits
 1313                  *
 1314                  * Don't allow anybody to deny reading basic
 1315                  * attributes or a files ACL.
 1316                  */
 1317                 if ((mask & (ACE_READ_ACL|ACE_READ_ATTRIBUTES)) &&
 1318                     (type == ACE_ACCESS_DENIED_ACE_TYPE))
 1319                         return (1);
 1320 
 1321                 /*
 1322                  * Delete permission is never set by default
 1323                  */
 1324                 if (mask & ACE_DELETE)
 1325                         return (1);
 1326 
 1327                 /*
 1328                  * Child delete permission should be accompanied by write
 1329                  */
 1330                 if ((mask & ACE_DELETE_CHILD) && !(mask & ACE_WRITE_DATA))
 1331                         return (1);
 1332 
 1333                 /*
 1334                  * only allow owner@ to have
 1335                  * write_acl/write_owner/write_attributes/write_xattr/
 1336                  */
 1337                 if (type == ACE_ACCESS_ALLOWED_ACE_TYPE &&
 1338                     (!(flags & ACE_OWNER) && (mask &
 1339                     (ACE_WRITE_OWNER|ACE_WRITE_ACL| ACE_WRITE_ATTRIBUTES|
 1340                     ACE_WRITE_NAMED_ATTRS))))
 1341                         return (1);
 1342 
 1343         }
 1344 
 1345         return (0);
 1346 }
 1347 
 1348 /*
 1349  * common code for setting ACLs.
 1350  *
 1351  * This function is called from zfs_mode_update, zfs_perm_init, and zfs_setacl.
 1352  * zfs_setacl passes a non-NULL inherit pointer (ihp) to indicate that it's
 1353  * already checked the acl and knows whether to inherit.
 1354  */
 1355 int
 1356 zfs_aclset_common(znode_t *zp, zfs_acl_t *aclp, cred_t *cr, dmu_tx_t *tx)
 1357 {
 1358         int                     error;
 1359         zfsvfs_t                *zfsvfs = ZTOZSB(zp);
 1360         dmu_object_type_t       otype;
 1361         zfs_acl_locator_cb_t    locate = { 0 };
 1362         uint64_t                mode;
 1363         sa_bulk_attr_t          bulk[5];
 1364         uint64_t                ctime[2];
 1365         int                     count = 0;
 1366         zfs_acl_phys_t          acl_phys;
 1367 
 1368         mode = zp->z_mode;
 1369 
 1370         mode = zfs_mode_compute(mode, aclp, &zp->z_pflags,
 1371             KUID_TO_SUID(ZTOI(zp)->i_uid), KGID_TO_SGID(ZTOI(zp)->i_gid));
 1372 
 1373         zp->z_mode = ZTOI(zp)->i_mode = mode;
 1374         SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_MODE(zfsvfs), NULL,
 1375             &mode, sizeof (mode));
 1376         SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_FLAGS(zfsvfs), NULL,
 1377             &zp->z_pflags, sizeof (zp->z_pflags));
 1378         SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_CTIME(zfsvfs), NULL,
 1379             &ctime, sizeof (ctime));
 1380 
 1381         if (zp->z_acl_cached) {
 1382                 zfs_acl_free(zp->z_acl_cached);
 1383                 zp->z_acl_cached = NULL;
 1384         }
 1385 
 1386         /*
 1387          * Upgrade needed?
 1388          */
 1389         if (!zfsvfs->z_use_fuids) {
 1390                 otype = DMU_OT_OLDACL;
 1391         } else {
 1392                 if ((aclp->z_version == ZFS_ACL_VERSION_INITIAL) &&
 1393                     (zfsvfs->z_version >= ZPL_VERSION_FUID))
 1394                         zfs_acl_xform(zp, aclp, cr);
 1395                 ASSERT(aclp->z_version >= ZFS_ACL_VERSION_FUID);
 1396                 otype = DMU_OT_ACL;
 1397         }
 1398 
 1399         /*
 1400          * Arrgh, we have to handle old on disk format
 1401          * as well as newer (preferred) SA format.
 1402          */
 1403 
 1404         if (zp->z_is_sa) { /* the easy case, just update the ACL attribute */
 1405                 locate.cb_aclp = aclp;
 1406                 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_DACL_ACES(zfsvfs),
 1407                     zfs_acl_data_locator, &locate, aclp->z_acl_bytes);
 1408                 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_DACL_COUNT(zfsvfs),
 1409                     NULL, &aclp->z_acl_count, sizeof (uint64_t));
 1410         } else { /* Painful legacy way */
 1411                 zfs_acl_node_t *aclnode;
 1412                 uint64_t off = 0;
 1413                 uint64_t aoid;
 1414 
 1415                 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zfsvfs),
 1416                     &acl_phys, sizeof (acl_phys))) != 0)
 1417                         return (error);
 1418 
 1419                 aoid = acl_phys.z_acl_extern_obj;
 1420 
 1421                 if (aclp->z_acl_bytes > ZFS_ACE_SPACE) {
 1422                         /*
 1423                          * If ACL was previously external and we are now
 1424                          * converting to new ACL format then release old
 1425                          * ACL object and create a new one.
 1426                          */
 1427                         if (aoid &&
 1428                             aclp->z_version != acl_phys.z_acl_version) {
 1429                                 error = dmu_object_free(zfsvfs->z_os, aoid, tx);
 1430                                 if (error)
 1431                                         return (error);
 1432                                 aoid = 0;
 1433                         }
 1434                         if (aoid == 0) {
 1435                                 aoid = dmu_object_alloc(zfsvfs->z_os,
 1436                                     otype, aclp->z_acl_bytes,
 1437                                     otype == DMU_OT_ACL ?
 1438                                     DMU_OT_SYSACL : DMU_OT_NONE,
 1439                                     otype == DMU_OT_ACL ?
 1440                                     DN_OLD_MAX_BONUSLEN : 0, tx);
 1441                         } else {
 1442                                 (void) dmu_object_set_blocksize(zfsvfs->z_os,
 1443                                     aoid, aclp->z_acl_bytes, 0, tx);
 1444                         }
 1445                         acl_phys.z_acl_extern_obj = aoid;
 1446                         for (aclnode = list_head(&aclp->z_acl); aclnode;
 1447                             aclnode = list_next(&aclp->z_acl, aclnode)) {
 1448                                 if (aclnode->z_ace_count == 0)
 1449                                         continue;
 1450                                 dmu_write(zfsvfs->z_os, aoid, off,
 1451                                     aclnode->z_size, aclnode->z_acldata, tx);
 1452                                 off += aclnode->z_size;
 1453                         }
 1454                 } else {
 1455                         void *start = acl_phys.z_ace_data;
 1456                         /*
 1457                          * Migrating back embedded?
 1458                          */
 1459                         if (acl_phys.z_acl_extern_obj) {
 1460                                 error = dmu_object_free(zfsvfs->z_os,
 1461                                     acl_phys.z_acl_extern_obj, tx);
 1462                                 if (error)
 1463                                         return (error);
 1464                                 acl_phys.z_acl_extern_obj = 0;
 1465                         }
 1466 
 1467                         for (aclnode = list_head(&aclp->z_acl); aclnode;
 1468                             aclnode = list_next(&aclp->z_acl, aclnode)) {
 1469                                 if (aclnode->z_ace_count == 0)
 1470                                         continue;
 1471                                 memcpy(start, aclnode->z_acldata,
 1472                                     aclnode->z_size);
 1473                                 start = (caddr_t)start + aclnode->z_size;
 1474                         }
 1475                 }
 1476                 /*
 1477                  * If Old version then swap count/bytes to match old
 1478                  * layout of znode_acl_phys_t.
 1479                  */
 1480                 if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) {
 1481                         acl_phys.z_acl_size = aclp->z_acl_count;
 1482                         acl_phys.z_acl_count = aclp->z_acl_bytes;
 1483                 } else {
 1484                         acl_phys.z_acl_size = aclp->z_acl_bytes;
 1485                         acl_phys.z_acl_count = aclp->z_acl_count;
 1486                 }
 1487                 acl_phys.z_acl_version = aclp->z_version;
 1488 
 1489                 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_ZNODE_ACL(zfsvfs), NULL,
 1490                     &acl_phys, sizeof (acl_phys));
 1491         }
 1492 
 1493         /*
 1494          * Replace ACL wide bits, but first clear them.
 1495          */
 1496         zp->z_pflags &= ~ZFS_ACL_WIDE_FLAGS;
 1497 
 1498         zp->z_pflags |= aclp->z_hints;
 1499 
 1500         if (ace_trivial_common(aclp, 0, zfs_ace_walk) == 0)
 1501                 zp->z_pflags |= ZFS_ACL_TRIVIAL;
 1502 
 1503         zfs_tstamp_update_setup(zp, STATE_CHANGED, NULL, ctime);
 1504         return (sa_bulk_update(zp->z_sa_hdl, bulk, count, tx));
 1505 }
 1506 
 1507 static void
 1508 zfs_acl_chmod(boolean_t isdir, uint64_t mode, boolean_t split, boolean_t trim,
 1509     zfs_acl_t *aclp)
 1510 {
 1511         void            *acep = NULL;
 1512         uint64_t        who;
 1513         int             new_count, new_bytes;
 1514         int             ace_size;
 1515         int             entry_type;
 1516         uint16_t        iflags, type;
 1517         uint32_t        access_mask;
 1518         zfs_acl_node_t  *newnode;
 1519         size_t          abstract_size = aclp->z_ops->ace_abstract_size();
 1520         void            *zacep;
 1521         trivial_acl_t   masks;
 1522 
 1523         new_count = new_bytes = 0;
 1524 
 1525         acl_trivial_access_masks((mode_t)mode, isdir, &masks);
 1526 
 1527         newnode = zfs_acl_node_alloc((abstract_size * 6) + aclp->z_acl_bytes);
 1528 
 1529         zacep = newnode->z_acldata;
 1530         if (masks.allow0) {
 1531                 zfs_set_ace(aclp, zacep, masks.allow0, ALLOW, -1, ACE_OWNER);
 1532                 zacep = (void *)((uintptr_t)zacep + abstract_size);
 1533                 new_count++;
 1534                 new_bytes += abstract_size;
 1535         }
 1536         if (masks.deny1) {
 1537                 zfs_set_ace(aclp, zacep, masks.deny1, DENY, -1, ACE_OWNER);
 1538                 zacep = (void *)((uintptr_t)zacep + abstract_size);
 1539                 new_count++;
 1540                 new_bytes += abstract_size;
 1541         }
 1542         if (masks.deny2) {
 1543                 zfs_set_ace(aclp, zacep, masks.deny2, DENY, -1, OWNING_GROUP);
 1544                 zacep = (void *)((uintptr_t)zacep + abstract_size);
 1545                 new_count++;
 1546                 new_bytes += abstract_size;
 1547         }
 1548 
 1549         while ((acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask,
 1550             &iflags, &type))) {
 1551                 entry_type = (iflags & ACE_TYPE_FLAGS);
 1552                 /*
 1553                  * ACEs used to represent the file mode may be divided
 1554                  * into an equivalent pair of inherit-only and regular
 1555                  * ACEs, if they are inheritable.
 1556                  * Skip regular ACEs, which are replaced by the new mode.
 1557                  */
 1558                 if (split && (entry_type == ACE_OWNER ||
 1559                     entry_type == OWNING_GROUP ||
 1560                     entry_type == ACE_EVERYONE)) {
 1561                         if (!isdir || !(iflags &
 1562                             (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE)))
 1563                                 continue;
 1564                         /*
 1565                          * We preserve owner@, group@, or @everyone
 1566                          * permissions, if they are inheritable, by
 1567                          * copying them to inherit_only ACEs. This
 1568                          * prevents inheritable permissions from being
 1569                          * altered along with the file mode.
 1570                          */
 1571                         iflags |= ACE_INHERIT_ONLY_ACE;
 1572                 }
 1573 
 1574                 /*
 1575                  * If this ACL has any inheritable ACEs, mark that in
 1576                  * the hints (which are later masked into the pflags)
 1577                  * so create knows to do inheritance.
 1578                  */
 1579                 if (isdir && (iflags &
 1580                     (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE)))
 1581                         aclp->z_hints |= ZFS_INHERIT_ACE;
 1582 
 1583                 if ((type != ALLOW && type != DENY) ||
 1584                     (iflags & ACE_INHERIT_ONLY_ACE)) {
 1585                         switch (type) {
 1586                         case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
 1587                         case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
 1588                         case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
 1589                         case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
 1590                                 aclp->z_hints |= ZFS_ACL_OBJ_ACE;
 1591                                 break;
 1592                         }
 1593                 } else {
 1594                         /*
 1595                          * Limit permissions to be no greater than
 1596                          * group permissions.
 1597                          * The "aclinherit" and "aclmode" properties
 1598                          * affect policy for create and chmod(2),
 1599                          * respectively.
 1600                          */
 1601                         if ((type == ALLOW) && trim)
 1602                                 access_mask &= masks.group;
 1603                 }
 1604                 zfs_set_ace(aclp, zacep, access_mask, type, who, iflags);
 1605                 ace_size = aclp->z_ops->ace_size(acep);
 1606                 zacep = (void *)((uintptr_t)zacep + ace_size);
 1607                 new_count++;
 1608                 new_bytes += ace_size;
 1609         }
 1610         zfs_set_ace(aclp, zacep, masks.owner, ALLOW, -1, ACE_OWNER);
 1611         zacep = (void *)((uintptr_t)zacep + abstract_size);
 1612         zfs_set_ace(aclp, zacep, masks.group, ALLOW, -1, OWNING_GROUP);
 1613         zacep = (void *)((uintptr_t)zacep + abstract_size);
 1614         zfs_set_ace(aclp, zacep, masks.everyone, ALLOW, -1, ACE_EVERYONE);
 1615 
 1616         new_count += 3;
 1617         new_bytes += abstract_size * 3;
 1618         zfs_acl_release_nodes(aclp);
 1619         aclp->z_acl_count = new_count;
 1620         aclp->z_acl_bytes = new_bytes;
 1621         newnode->z_ace_count = new_count;
 1622         newnode->z_size = new_bytes;
 1623         list_insert_tail(&aclp->z_acl, newnode);
 1624 }
 1625 
 1626 int
 1627 zfs_acl_chmod_setattr(znode_t *zp, zfs_acl_t **aclp, uint64_t mode)
 1628 {
 1629         int error = 0;
 1630 
 1631         mutex_enter(&zp->z_acl_lock);
 1632         mutex_enter(&zp->z_lock);
 1633         if (ZTOZSB(zp)->z_acl_mode == ZFS_ACL_DISCARD)
 1634                 *aclp = zfs_acl_alloc(zfs_acl_version_zp(zp));
 1635         else
 1636                 error = zfs_acl_node_read(zp, B_TRUE, aclp, B_TRUE);
 1637 
 1638         if (error == 0) {
 1639                 (*aclp)->z_hints = zp->z_pflags & V4_ACL_WIDE_FLAGS;
 1640                 zfs_acl_chmod(S_ISDIR(ZTOI(zp)->i_mode), mode, B_TRUE,
 1641                     (ZTOZSB(zp)->z_acl_mode == ZFS_ACL_GROUPMASK), *aclp);
 1642         }
 1643         mutex_exit(&zp->z_lock);
 1644         mutex_exit(&zp->z_acl_lock);
 1645 
 1646         return (error);
 1647 }
 1648 
 1649 /*
 1650  * Should ACE be inherited?
 1651  */
 1652 static int
 1653 zfs_ace_can_use(umode_t obj_mode, uint16_t acep_flags)
 1654 {
 1655         int     iflags = (acep_flags & 0xf);
 1656 
 1657         if (S_ISDIR(obj_mode) && (iflags & ACE_DIRECTORY_INHERIT_ACE))
 1658                 return (1);
 1659         else if (iflags & ACE_FILE_INHERIT_ACE)
 1660                 return (!(S_ISDIR(obj_mode) &&
 1661                     (iflags & ACE_NO_PROPAGATE_INHERIT_ACE)));
 1662         return (0);
 1663 }
 1664 
 1665 /*
 1666  * inherit inheritable ACEs from parent
 1667  */
 1668 static zfs_acl_t *
 1669 zfs_acl_inherit(zfsvfs_t *zfsvfs, umode_t va_mode, zfs_acl_t *paclp,
 1670     uint64_t mode, boolean_t *need_chmod)
 1671 {
 1672         void            *pacep = NULL;
 1673         void            *acep;
 1674         zfs_acl_node_t  *aclnode;
 1675         zfs_acl_t       *aclp = NULL;
 1676         uint64_t        who;
 1677         uint32_t        access_mask;
 1678         uint16_t        iflags, newflags, type;
 1679         size_t          ace_size;
 1680         void            *data1, *data2;
 1681         size_t          data1sz, data2sz;
 1682         uint_t          aclinherit;
 1683         boolean_t       isdir = S_ISDIR(va_mode);
 1684         boolean_t       isreg = S_ISREG(va_mode);
 1685 
 1686         *need_chmod = B_TRUE;
 1687 
 1688         aclp = zfs_acl_alloc(paclp->z_version);
 1689         aclinherit = zfsvfs->z_acl_inherit;
 1690         if (aclinherit == ZFS_ACL_DISCARD || S_ISLNK(va_mode))
 1691                 return (aclp);
 1692 
 1693         while ((pacep = zfs_acl_next_ace(paclp, pacep, &who,
 1694             &access_mask, &iflags, &type))) {
 1695 
 1696                 /*
 1697                  * don't inherit bogus ACEs
 1698                  */
 1699                 if (!zfs_acl_valid_ace_type(type, iflags))
 1700                         continue;
 1701 
 1702                 /*
 1703                  * Check if ACE is inheritable by this vnode
 1704                  */
 1705                 if ((aclinherit == ZFS_ACL_NOALLOW && type == ALLOW) ||
 1706                     !zfs_ace_can_use(va_mode, iflags))
 1707                         continue;
 1708 
 1709                 /*
 1710                  * If owner@, group@, or everyone@ inheritable
 1711                  * then zfs_acl_chmod() isn't needed.
 1712                  */
 1713                 if ((aclinherit == ZFS_ACL_PASSTHROUGH ||
 1714                     aclinherit == ZFS_ACL_PASSTHROUGH_X) &&
 1715                     ((iflags & (ACE_OWNER|ACE_EVERYONE)) ||
 1716                     ((iflags & OWNING_GROUP) == OWNING_GROUP)) &&
 1717                     (isreg || (isdir && (iflags & ACE_DIRECTORY_INHERIT_ACE))))
 1718                         *need_chmod = B_FALSE;
 1719 
 1720                 /*
 1721                  * Strip inherited execute permission from file if
 1722                  * not in mode
 1723                  */
 1724                 if (aclinherit == ZFS_ACL_PASSTHROUGH_X && type == ALLOW &&
 1725                     !isdir && ((mode & (S_IXUSR|S_IXGRP|S_IXOTH)) == 0)) {
 1726                         access_mask &= ~ACE_EXECUTE;
 1727                 }
 1728 
 1729                 /*
 1730                  * Strip write_acl and write_owner from permissions
 1731                  * when inheriting an ACE
 1732                  */
 1733                 if (aclinherit == ZFS_ACL_RESTRICTED && type == ALLOW) {
 1734                         access_mask &= ~RESTRICTED_CLEAR;
 1735                 }
 1736 
 1737                 ace_size = aclp->z_ops->ace_size(pacep);
 1738                 aclnode = zfs_acl_node_alloc(ace_size);
 1739                 list_insert_tail(&aclp->z_acl, aclnode);
 1740                 acep = aclnode->z_acldata;
 1741 
 1742                 zfs_set_ace(aclp, acep, access_mask, type,
 1743                     who, iflags|ACE_INHERITED_ACE);
 1744 
 1745                 /*
 1746                  * Copy special opaque data if any
 1747                  */
 1748                 if ((data1sz = paclp->z_ops->ace_data(pacep, &data1)) != 0) {
 1749                         VERIFY((data2sz = aclp->z_ops->ace_data(acep,
 1750                             &data2)) == data1sz);
 1751                         memcpy(data2, data1, data2sz);
 1752                 }
 1753 
 1754                 aclp->z_acl_count++;
 1755                 aclnode->z_ace_count++;
 1756                 aclp->z_acl_bytes += aclnode->z_size;
 1757                 newflags = aclp->z_ops->ace_flags_get(acep);
 1758 
 1759                 /*
 1760                  * If ACE is not to be inherited further, or if the vnode is
 1761                  * not a directory, remove all inheritance flags
 1762                  */
 1763                 if (!isdir || (iflags & ACE_NO_PROPAGATE_INHERIT_ACE)) {
 1764                         newflags &= ~ALL_INHERIT;
 1765                         aclp->z_ops->ace_flags_set(acep,
 1766                             newflags|ACE_INHERITED_ACE);
 1767                         continue;
 1768                 }
 1769 
 1770                 /*
 1771                  * This directory has an inheritable ACE
 1772                  */
 1773                 aclp->z_hints |= ZFS_INHERIT_ACE;
 1774 
 1775                 /*
 1776                  * If only FILE_INHERIT is set then turn on
 1777                  * inherit_only
 1778                  */
 1779                 if ((iflags & (ACE_FILE_INHERIT_ACE |
 1780                     ACE_DIRECTORY_INHERIT_ACE)) == ACE_FILE_INHERIT_ACE) {
 1781                         newflags |= ACE_INHERIT_ONLY_ACE;
 1782                         aclp->z_ops->ace_flags_set(acep,
 1783                             newflags|ACE_INHERITED_ACE);
 1784                 } else {
 1785                         newflags &= ~ACE_INHERIT_ONLY_ACE;
 1786                         aclp->z_ops->ace_flags_set(acep,
 1787                             newflags|ACE_INHERITED_ACE);
 1788                 }
 1789         }
 1790         if (zfsvfs->z_acl_mode == ZFS_ACL_RESTRICTED &&
 1791             aclp->z_acl_count != 0) {
 1792                 *need_chmod = B_FALSE;
 1793         }
 1794 
 1795         return (aclp);
 1796 }
 1797 
 1798 /*
 1799  * Create file system object initial permissions
 1800  * including inheritable ACEs.
 1801  * Also, create FUIDs for owner and group.
 1802  */
 1803 int
 1804 zfs_acl_ids_create(znode_t *dzp, int flag, vattr_t *vap, cred_t *cr,
 1805     vsecattr_t *vsecp, zfs_acl_ids_t *acl_ids, zuserns_t *mnt_ns)
 1806 {
 1807         int             error;
 1808         zfsvfs_t        *zfsvfs = ZTOZSB(dzp);
 1809         zfs_acl_t       *paclp;
 1810         gid_t           gid = vap->va_gid;
 1811         boolean_t       need_chmod = B_TRUE;
 1812         boolean_t       trim = B_FALSE;
 1813         boolean_t       inherited = B_FALSE;
 1814 
 1815         memset(acl_ids, 0, sizeof (zfs_acl_ids_t));
 1816         acl_ids->z_mode = vap->va_mode;
 1817 
 1818         if (vsecp)
 1819                 if ((error = zfs_vsec_2_aclp(zfsvfs, vap->va_mode, vsecp,
 1820                     cr, &acl_ids->z_fuidp, &acl_ids->z_aclp)) != 0)
 1821                         return (error);
 1822 
 1823         acl_ids->z_fuid = vap->va_uid;
 1824         acl_ids->z_fgid = vap->va_gid;
 1825 #ifdef HAVE_KSID
 1826         /*
 1827          * Determine uid and gid.
 1828          */
 1829         if ((flag & IS_ROOT_NODE) || zfsvfs->z_replay ||
 1830             ((flag & IS_XATTR) && (S_ISDIR(vap->va_mode)))) {
 1831                 acl_ids->z_fuid = zfs_fuid_create(zfsvfs, (uint64_t)vap->va_uid,
 1832                     cr, ZFS_OWNER, &acl_ids->z_fuidp);
 1833                 acl_ids->z_fgid = zfs_fuid_create(zfsvfs, (uint64_t)vap->va_gid,
 1834                     cr, ZFS_GROUP, &acl_ids->z_fuidp);
 1835                 gid = vap->va_gid;
 1836         } else {
 1837                 acl_ids->z_fuid = zfs_fuid_create_cred(zfsvfs, ZFS_OWNER,
 1838                     cr, &acl_ids->z_fuidp);
 1839                 acl_ids->z_fgid = 0;
 1840                 if (vap->va_mask & AT_GID)  {
 1841                         acl_ids->z_fgid = zfs_fuid_create(zfsvfs,
 1842                             (uint64_t)vap->va_gid,
 1843                             cr, ZFS_GROUP, &acl_ids->z_fuidp);
 1844                         gid = vap->va_gid;
 1845                         if (acl_ids->z_fgid != KGID_TO_SGID(ZTOI(dzp)->i_gid) &&
 1846                             !groupmember(vap->va_gid, cr) &&
 1847                             secpolicy_vnode_create_gid(cr) != 0)
 1848                                 acl_ids->z_fgid = 0;
 1849                 }
 1850                 if (acl_ids->z_fgid == 0) {
 1851                         if (dzp->z_mode & S_ISGID) {
 1852                                 char            *domain;
 1853                                 uint32_t        rid;
 1854 
 1855                                 acl_ids->z_fgid = KGID_TO_SGID(
 1856                                     ZTOI(dzp)->i_gid);
 1857                                 gid = zfs_fuid_map_id(zfsvfs, acl_ids->z_fgid,
 1858                                     cr, ZFS_GROUP);
 1859 
 1860                                 if (zfsvfs->z_use_fuids &&
 1861                                     IS_EPHEMERAL(acl_ids->z_fgid)) {
 1862                                         domain = zfs_fuid_idx_domain(
 1863                                             &zfsvfs->z_fuid_idx,
 1864                                             FUID_INDEX(acl_ids->z_fgid));
 1865                                         rid = FUID_RID(acl_ids->z_fgid);
 1866                                         zfs_fuid_node_add(&acl_ids->z_fuidp,
 1867                                             domain, rid,
 1868                                             FUID_INDEX(acl_ids->z_fgid),
 1869                                             acl_ids->z_fgid, ZFS_GROUP);
 1870                                 }
 1871                         } else {
 1872                                 acl_ids->z_fgid = zfs_fuid_create_cred(zfsvfs,
 1873                                     ZFS_GROUP, cr, &acl_ids->z_fuidp);
 1874                                 gid = crgetgid(cr);
 1875                         }
 1876                 }
 1877         }
 1878 #endif /* HAVE_KSID */
 1879 
 1880         /*
 1881          * If we're creating a directory, and the parent directory has the
 1882          * set-GID bit set, set in on the new directory.
 1883          * Otherwise, if the user is neither privileged nor a member of the
 1884          * file's new group, clear the file's set-GID bit.
 1885          */
 1886 
 1887         if (!(flag & IS_ROOT_NODE) && (dzp->z_mode & S_ISGID) &&
 1888             (S_ISDIR(vap->va_mode))) {
 1889                 acl_ids->z_mode |= S_ISGID;
 1890         } else {
 1891                 if ((acl_ids->z_mode & S_ISGID) &&
 1892                     secpolicy_vnode_setids_setgids(cr, gid, mnt_ns,
 1893                     zfs_i_user_ns(ZTOI(dzp))) != 0) {
 1894                         acl_ids->z_mode &= ~S_ISGID;
 1895                 }
 1896         }
 1897 
 1898         if (acl_ids->z_aclp == NULL) {
 1899                 mutex_enter(&dzp->z_acl_lock);
 1900                 mutex_enter(&dzp->z_lock);
 1901                 if (!(flag & IS_ROOT_NODE) &&
 1902                     (dzp->z_pflags & ZFS_INHERIT_ACE) &&
 1903                     !(dzp->z_pflags & ZFS_XATTR)) {
 1904                         VERIFY(0 == zfs_acl_node_read(dzp, B_TRUE,
 1905                             &paclp, B_FALSE));
 1906                         acl_ids->z_aclp = zfs_acl_inherit(zfsvfs,
 1907                             vap->va_mode, paclp, acl_ids->z_mode, &need_chmod);
 1908                         inherited = B_TRUE;
 1909                 } else {
 1910                         acl_ids->z_aclp =
 1911                             zfs_acl_alloc(zfs_acl_version_zp(dzp));
 1912                         acl_ids->z_aclp->z_hints |= ZFS_ACL_TRIVIAL;
 1913                 }
 1914                 mutex_exit(&dzp->z_lock);
 1915                 mutex_exit(&dzp->z_acl_lock);
 1916 
 1917                 if (need_chmod) {
 1918                         if (S_ISDIR(vap->va_mode))
 1919                                 acl_ids->z_aclp->z_hints |=
 1920                                     ZFS_ACL_AUTO_INHERIT;
 1921 
 1922                         if (zfsvfs->z_acl_mode == ZFS_ACL_GROUPMASK &&
 1923                             zfsvfs->z_acl_inherit != ZFS_ACL_PASSTHROUGH &&
 1924                             zfsvfs->z_acl_inherit != ZFS_ACL_PASSTHROUGH_X)
 1925                                 trim = B_TRUE;
 1926                         zfs_acl_chmod(vap->va_mode, acl_ids->z_mode, B_FALSE,
 1927                             trim, acl_ids->z_aclp);
 1928                 }
 1929         }
 1930 
 1931         if (inherited || vsecp) {
 1932                 acl_ids->z_mode = zfs_mode_compute(acl_ids->z_mode,
 1933                     acl_ids->z_aclp, &acl_ids->z_aclp->z_hints,
 1934                     acl_ids->z_fuid, acl_ids->z_fgid);
 1935                 if (ace_trivial_common(acl_ids->z_aclp, 0, zfs_ace_walk) == 0)
 1936                         acl_ids->z_aclp->z_hints |= ZFS_ACL_TRIVIAL;
 1937         }
 1938 
 1939         return (0);
 1940 }
 1941 
 1942 /*
 1943  * Free ACL and fuid_infop, but not the acl_ids structure
 1944  */
 1945 void
 1946 zfs_acl_ids_free(zfs_acl_ids_t *acl_ids)
 1947 {
 1948         if (acl_ids->z_aclp)
 1949                 zfs_acl_free(acl_ids->z_aclp);
 1950         if (acl_ids->z_fuidp)
 1951                 zfs_fuid_info_free(acl_ids->z_fuidp);
 1952         acl_ids->z_aclp = NULL;
 1953         acl_ids->z_fuidp = NULL;
 1954 }
 1955 
 1956 boolean_t
 1957 zfs_acl_ids_overquota(zfsvfs_t *zv, zfs_acl_ids_t *acl_ids, uint64_t projid)
 1958 {
 1959         return (zfs_id_overquota(zv, DMU_USERUSED_OBJECT, acl_ids->z_fuid) ||
 1960             zfs_id_overquota(zv, DMU_GROUPUSED_OBJECT, acl_ids->z_fgid) ||
 1961             (projid != ZFS_DEFAULT_PROJID && projid != ZFS_INVALID_PROJID &&
 1962             zfs_id_overquota(zv, DMU_PROJECTUSED_OBJECT, projid)));
 1963 }
 1964 
 1965 /*
 1966  * Retrieve a file's ACL
 1967  */
 1968 int
 1969 zfs_getacl(znode_t *zp, vsecattr_t *vsecp, boolean_t skipaclchk, cred_t *cr)
 1970 {
 1971         zfs_acl_t       *aclp;
 1972         ulong_t         mask;
 1973         int             error;
 1974         int             count = 0;
 1975         int             largeace = 0;
 1976 
 1977         mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT |
 1978             VSA_ACE_ACLFLAGS | VSA_ACE_ALLTYPES);
 1979 
 1980         if (mask == 0)
 1981                 return (SET_ERROR(ENOSYS));
 1982 
 1983         if ((error = zfs_zaccess(zp, ACE_READ_ACL, 0, skipaclchk, cr,
 1984             kcred->user_ns)))
 1985                 return (error);
 1986 
 1987         mutex_enter(&zp->z_acl_lock);
 1988 
 1989         error = zfs_acl_node_read(zp, B_FALSE, &aclp, B_FALSE);
 1990         if (error != 0) {
 1991                 mutex_exit(&zp->z_acl_lock);
 1992                 return (error);
 1993         }
 1994 
 1995         /*
 1996          * Scan ACL to determine number of ACEs
 1997          */
 1998         if ((zp->z_pflags & ZFS_ACL_OBJ_ACE) && !(mask & VSA_ACE_ALLTYPES)) {
 1999                 void *zacep = NULL;
 2000                 uint64_t who;
 2001                 uint32_t access_mask;
 2002                 uint16_t type, iflags;
 2003 
 2004                 while ((zacep = zfs_acl_next_ace(aclp, zacep,
 2005                     &who, &access_mask, &iflags, &type))) {
 2006                         switch (type) {
 2007                         case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
 2008                         case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
 2009                         case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
 2010                         case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
 2011                                 largeace++;
 2012                                 continue;
 2013                         default:
 2014                                 count++;
 2015                         }
 2016                 }
 2017                 vsecp->vsa_aclcnt = count;
 2018         } else
 2019                 count = (int)aclp->z_acl_count;
 2020 
 2021         if (mask & VSA_ACECNT) {
 2022                 vsecp->vsa_aclcnt = count;
 2023         }
 2024 
 2025         if (mask & VSA_ACE) {
 2026                 size_t aclsz;
 2027 
 2028                 aclsz = count * sizeof (ace_t) +
 2029                     sizeof (ace_object_t) * largeace;
 2030 
 2031                 vsecp->vsa_aclentp = kmem_alloc(aclsz, KM_SLEEP);
 2032                 vsecp->vsa_aclentsz = aclsz;
 2033 
 2034                 if (aclp->z_version == ZFS_ACL_VERSION_FUID)
 2035                         zfs_copy_fuid_2_ace(ZTOZSB(zp), aclp, cr,
 2036                             vsecp->vsa_aclentp, !(mask & VSA_ACE_ALLTYPES));
 2037                 else {
 2038                         zfs_acl_node_t *aclnode;
 2039                         void *start = vsecp->vsa_aclentp;
 2040 
 2041                         for (aclnode = list_head(&aclp->z_acl); aclnode;
 2042                             aclnode = list_next(&aclp->z_acl, aclnode)) {
 2043                                 memcpy(start, aclnode->z_acldata,
 2044                                     aclnode->z_size);
 2045                                 start = (caddr_t)start + aclnode->z_size;
 2046                         }
 2047                         ASSERT((caddr_t)start - (caddr_t)vsecp->vsa_aclentp ==
 2048                             aclp->z_acl_bytes);
 2049                 }
 2050         }
 2051         if (mask & VSA_ACE_ACLFLAGS) {
 2052                 vsecp->vsa_aclflags = 0;
 2053                 if (zp->z_pflags & ZFS_ACL_DEFAULTED)
 2054                         vsecp->vsa_aclflags |= ACL_DEFAULTED;
 2055                 if (zp->z_pflags & ZFS_ACL_PROTECTED)
 2056                         vsecp->vsa_aclflags |= ACL_PROTECTED;
 2057                 if (zp->z_pflags & ZFS_ACL_AUTO_INHERIT)
 2058                         vsecp->vsa_aclflags |= ACL_AUTO_INHERIT;
 2059         }
 2060 
 2061         mutex_exit(&zp->z_acl_lock);
 2062 
 2063         return (0);
 2064 }
 2065 
 2066 int
 2067 zfs_vsec_2_aclp(zfsvfs_t *zfsvfs, umode_t obj_mode,
 2068     vsecattr_t *vsecp, cred_t *cr, zfs_fuid_info_t **fuidp, zfs_acl_t **zaclp)
 2069 {
 2070         zfs_acl_t *aclp;
 2071         zfs_acl_node_t *aclnode;
 2072         int aclcnt = vsecp->vsa_aclcnt;
 2073         int error;
 2074 
 2075         if (vsecp->vsa_aclcnt > MAX_ACL_ENTRIES || vsecp->vsa_aclcnt <= 0)
 2076                 return (SET_ERROR(EINVAL));
 2077 
 2078         aclp = zfs_acl_alloc(zfs_acl_version(zfsvfs->z_version));
 2079 
 2080         aclp->z_hints = 0;
 2081         aclnode = zfs_acl_node_alloc(aclcnt * sizeof (zfs_object_ace_t));
 2082         if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) {
 2083                 if ((error = zfs_copy_ace_2_oldace(obj_mode, aclp,
 2084                     (ace_t *)vsecp->vsa_aclentp, aclnode->z_acldata,
 2085                     aclcnt, &aclnode->z_size)) != 0) {
 2086                         zfs_acl_free(aclp);
 2087                         zfs_acl_node_free(aclnode);
 2088                         return (error);
 2089                 }
 2090         } else {
 2091                 if ((error = zfs_copy_ace_2_fuid(zfsvfs, obj_mode, aclp,
 2092                     vsecp->vsa_aclentp, aclnode->z_acldata, aclcnt,
 2093                     &aclnode->z_size, fuidp, cr)) != 0) {
 2094                         zfs_acl_free(aclp);
 2095                         zfs_acl_node_free(aclnode);
 2096                         return (error);
 2097                 }
 2098         }
 2099         aclp->z_acl_bytes = aclnode->z_size;
 2100         aclnode->z_ace_count = aclcnt;
 2101         aclp->z_acl_count = aclcnt;
 2102         list_insert_head(&aclp->z_acl, aclnode);
 2103 
 2104         /*
 2105          * If flags are being set then add them to z_hints
 2106          */
 2107         if (vsecp->vsa_mask & VSA_ACE_ACLFLAGS) {
 2108                 if (vsecp->vsa_aclflags & ACL_PROTECTED)
 2109                         aclp->z_hints |= ZFS_ACL_PROTECTED;
 2110                 if (vsecp->vsa_aclflags & ACL_DEFAULTED)
 2111                         aclp->z_hints |= ZFS_ACL_DEFAULTED;
 2112                 if (vsecp->vsa_aclflags & ACL_AUTO_INHERIT)
 2113                         aclp->z_hints |= ZFS_ACL_AUTO_INHERIT;
 2114         }
 2115 
 2116         *zaclp = aclp;
 2117 
 2118         return (0);
 2119 }
 2120 
 2121 /*
 2122  * Set a file's ACL
 2123  */
 2124 int
 2125 zfs_setacl(znode_t *zp, vsecattr_t *vsecp, boolean_t skipaclchk, cred_t *cr)
 2126 {
 2127         zfsvfs_t        *zfsvfs = ZTOZSB(zp);
 2128         zilog_t         *zilog = zfsvfs->z_log;
 2129         ulong_t         mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT);
 2130         dmu_tx_t        *tx;
 2131         int             error;
 2132         zfs_acl_t       *aclp;
 2133         zfs_fuid_info_t *fuidp = NULL;
 2134         boolean_t       fuid_dirtied;
 2135         uint64_t        acl_obj;
 2136 
 2137         if (mask == 0)
 2138                 return (SET_ERROR(ENOSYS));
 2139 
 2140         if (zp->z_pflags & ZFS_IMMUTABLE)
 2141                 return (SET_ERROR(EPERM));
 2142 
 2143         if ((error = zfs_zaccess(zp, ACE_WRITE_ACL, 0, skipaclchk, cr,
 2144             kcred->user_ns)))
 2145                 return (error);
 2146 
 2147         error = zfs_vsec_2_aclp(zfsvfs, ZTOI(zp)->i_mode, vsecp, cr, &fuidp,
 2148             &aclp);
 2149         if (error)
 2150                 return (error);
 2151 
 2152         /*
 2153          * If ACL wide flags aren't being set then preserve any
 2154          * existing flags.
 2155          */
 2156         if (!(vsecp->vsa_mask & VSA_ACE_ACLFLAGS)) {
 2157                 aclp->z_hints |=
 2158                     (zp->z_pflags & V4_ACL_WIDE_FLAGS);
 2159         }
 2160 top:
 2161         mutex_enter(&zp->z_acl_lock);
 2162         mutex_enter(&zp->z_lock);
 2163 
 2164         tx = dmu_tx_create(zfsvfs->z_os);
 2165 
 2166         dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_TRUE);
 2167 
 2168         fuid_dirtied = zfsvfs->z_fuid_dirty;
 2169         if (fuid_dirtied)
 2170                 zfs_fuid_txhold(zfsvfs, tx);
 2171 
 2172         /*
 2173          * If old version and ACL won't fit in bonus and we aren't
 2174          * upgrading then take out necessary DMU holds
 2175          */
 2176 
 2177         if ((acl_obj = zfs_external_acl(zp)) != 0) {
 2178                 if (zfsvfs->z_version >= ZPL_VERSION_FUID &&
 2179                     zfs_znode_acl_version(zp) <= ZFS_ACL_VERSION_INITIAL) {
 2180                         dmu_tx_hold_free(tx, acl_obj, 0,
 2181                             DMU_OBJECT_END);
 2182                         dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0,
 2183                             aclp->z_acl_bytes);
 2184                 } else {
 2185                         dmu_tx_hold_write(tx, acl_obj, 0, aclp->z_acl_bytes);
 2186                 }
 2187         } else if (!zp->z_is_sa && aclp->z_acl_bytes > ZFS_ACE_SPACE) {
 2188                 dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0, aclp->z_acl_bytes);
 2189         }
 2190 
 2191         zfs_sa_upgrade_txholds(tx, zp);
 2192         error = dmu_tx_assign(tx, TXG_NOWAIT);
 2193         if (error) {
 2194                 mutex_exit(&zp->z_acl_lock);
 2195                 mutex_exit(&zp->z_lock);
 2196 
 2197                 if (error == ERESTART) {
 2198                         dmu_tx_wait(tx);
 2199                         dmu_tx_abort(tx);
 2200                         goto top;
 2201                 }
 2202                 dmu_tx_abort(tx);
 2203                 zfs_acl_free(aclp);
 2204                 return (error);
 2205         }
 2206 
 2207         error = zfs_aclset_common(zp, aclp, cr, tx);
 2208         ASSERT(error == 0);
 2209         ASSERT(zp->z_acl_cached == NULL);
 2210         zp->z_acl_cached = aclp;
 2211 
 2212         if (fuid_dirtied)
 2213                 zfs_fuid_sync(zfsvfs, tx);
 2214 
 2215         zfs_log_acl(zilog, tx, zp, vsecp, fuidp);
 2216 
 2217         if (fuidp)
 2218                 zfs_fuid_info_free(fuidp);
 2219         dmu_tx_commit(tx);
 2220 
 2221         mutex_exit(&zp->z_lock);
 2222         mutex_exit(&zp->z_acl_lock);
 2223 
 2224         return (error);
 2225 }
 2226 
 2227 /*
 2228  * Check accesses of interest (AoI) against attributes of the dataset
 2229  * such as read-only.  Returns zero if no AoI conflict with dataset
 2230  * attributes, otherwise an appropriate errno is returned.
 2231  */
 2232 static int
 2233 zfs_zaccess_dataset_check(znode_t *zp, uint32_t v4_mode)
 2234 {
 2235         if ((v4_mode & WRITE_MASK) && (zfs_is_readonly(ZTOZSB(zp))) &&
 2236             (!Z_ISDEV(ZTOI(zp)->i_mode) || (v4_mode & WRITE_MASK_ATTRS))) {
 2237                 return (SET_ERROR(EROFS));
 2238         }
 2239 
 2240         /*
 2241          * Intentionally allow ZFS_READONLY through here.
 2242          * See zfs_zaccess_common().
 2243          */
 2244         if ((v4_mode & WRITE_MASK_DATA) &&
 2245             (zp->z_pflags & ZFS_IMMUTABLE)) {
 2246                 return (SET_ERROR(EPERM));
 2247         }
 2248 
 2249         if ((v4_mode & (ACE_DELETE | ACE_DELETE_CHILD)) &&
 2250             (zp->z_pflags & ZFS_NOUNLINK)) {
 2251                 return (SET_ERROR(EPERM));
 2252         }
 2253 
 2254         if (((v4_mode & (ACE_READ_DATA|ACE_EXECUTE)) &&
 2255             (zp->z_pflags & ZFS_AV_QUARANTINED))) {
 2256                 return (SET_ERROR(EACCES));
 2257         }
 2258 
 2259         return (0);
 2260 }
 2261 
 2262 /*
 2263  * The primary usage of this function is to loop through all of the
 2264  * ACEs in the znode, determining what accesses of interest (AoI) to
 2265  * the caller are allowed or denied.  The AoI are expressed as bits in
 2266  * the working_mode parameter.  As each ACE is processed, bits covered
 2267  * by that ACE are removed from the working_mode.  This removal
 2268  * facilitates two things.  The first is that when the working mode is
 2269  * empty (= 0), we know we've looked at all the AoI. The second is
 2270  * that the ACE interpretation rules don't allow a later ACE to undo
 2271  * something granted or denied by an earlier ACE.  Removing the
 2272  * discovered access or denial enforces this rule.  At the end of
 2273  * processing the ACEs, all AoI that were found to be denied are
 2274  * placed into the working_mode, giving the caller a mask of denied
 2275  * accesses.  Returns:
 2276  *      0               if all AoI granted
 2277  *      EACCES          if the denied mask is non-zero
 2278  *      other error     if abnormal failure (e.g., IO error)
 2279  *
 2280  * A secondary usage of the function is to determine if any of the
 2281  * AoI are granted.  If an ACE grants any access in
 2282  * the working_mode, we immediately short circuit out of the function.
 2283  * This mode is chosen by setting anyaccess to B_TRUE.  The
 2284  * working_mode is not a denied access mask upon exit if the function
 2285  * is used in this manner.
 2286  */
 2287 static int
 2288 zfs_zaccess_aces_check(znode_t *zp, uint32_t *working_mode,
 2289     boolean_t anyaccess, cred_t *cr, zuserns_t *mnt_ns)
 2290 {
 2291         zfsvfs_t        *zfsvfs = ZTOZSB(zp);
 2292         zfs_acl_t       *aclp;
 2293         int             error;
 2294         uid_t           uid = crgetuid(cr);
 2295         uint64_t        who;
 2296         uint16_t        type, iflags;
 2297         uint16_t        entry_type;
 2298         uint32_t        access_mask;
 2299         uint32_t        deny_mask = 0;
 2300         zfs_ace_hdr_t   *acep = NULL;
 2301         boolean_t       checkit;
 2302         uid_t           gowner;
 2303         uid_t           fowner;
 2304 
 2305         if (mnt_ns) {
 2306                 fowner = zfs_uid_to_vfsuid(mnt_ns, zfs_i_user_ns(ZTOI(zp)),
 2307                     KUID_TO_SUID(ZTOI(zp)->i_uid));
 2308                 gowner = zfs_gid_to_vfsgid(mnt_ns, zfs_i_user_ns(ZTOI(zp)),
 2309                     KGID_TO_SGID(ZTOI(zp)->i_gid));
 2310         } else
 2311                 zfs_fuid_map_ids(zp, cr, &fowner, &gowner);
 2312 
 2313         mutex_enter(&zp->z_acl_lock);
 2314 
 2315         error = zfs_acl_node_read(zp, B_FALSE, &aclp, B_FALSE);
 2316         if (error != 0) {
 2317                 mutex_exit(&zp->z_acl_lock);
 2318                 return (error);
 2319         }
 2320 
 2321         ASSERT(zp->z_acl_cached);
 2322 
 2323         while ((acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask,
 2324             &iflags, &type))) {
 2325                 uint32_t mask_matched;
 2326 
 2327                 if (!zfs_acl_valid_ace_type(type, iflags))
 2328                         continue;
 2329 
 2330                 if (S_ISDIR(ZTOI(zp)->i_mode) &&
 2331                     (iflags & ACE_INHERIT_ONLY_ACE))
 2332                         continue;
 2333 
 2334                 /* Skip ACE if it does not affect any AoI */
 2335                 mask_matched = (access_mask & *working_mode);
 2336                 if (!mask_matched)
 2337                         continue;
 2338 
 2339                 entry_type = (iflags & ACE_TYPE_FLAGS);
 2340 
 2341                 checkit = B_FALSE;
 2342 
 2343                 switch (entry_type) {
 2344                 case ACE_OWNER:
 2345                         if (uid == fowner)
 2346                                 checkit = B_TRUE;
 2347                         break;
 2348                 case OWNING_GROUP:
 2349                         who = gowner;
 2350                         zfs_fallthrough;
 2351                 case ACE_IDENTIFIER_GROUP:
 2352                         checkit = zfs_groupmember(zfsvfs, who, cr);
 2353                         break;
 2354                 case ACE_EVERYONE:
 2355                         checkit = B_TRUE;
 2356                         break;
 2357 
 2358                 /* USER Entry */
 2359                 default:
 2360                         if (entry_type == 0) {
 2361                                 uid_t newid;
 2362 
 2363                                 newid = zfs_fuid_map_id(zfsvfs, who, cr,
 2364                                     ZFS_ACE_USER);
 2365                                 if (newid != IDMAP_WK_CREATOR_OWNER_UID &&
 2366                                     uid == newid)
 2367                                         checkit = B_TRUE;
 2368                                 break;
 2369                         } else {
 2370                                 mutex_exit(&zp->z_acl_lock);
 2371                                 return (SET_ERROR(EIO));
 2372                         }
 2373                 }
 2374 
 2375                 if (checkit) {
 2376                         if (type == DENY) {
 2377                                 DTRACE_PROBE3(zfs__ace__denies,
 2378                                     znode_t *, zp,
 2379                                     zfs_ace_hdr_t *, acep,
 2380                                     uint32_t, mask_matched);
 2381                                 deny_mask |= mask_matched;
 2382                         } else {
 2383                                 DTRACE_PROBE3(zfs__ace__allows,
 2384                                     znode_t *, zp,
 2385                                     zfs_ace_hdr_t *, acep,
 2386                                     uint32_t, mask_matched);
 2387                                 if (anyaccess) {
 2388                                         mutex_exit(&zp->z_acl_lock);
 2389                                         return (0);
 2390                                 }
 2391                         }
 2392                         *working_mode &= ~mask_matched;
 2393                 }
 2394 
 2395                 /* Are we done? */
 2396                 if (*working_mode == 0)
 2397                         break;
 2398         }
 2399 
 2400         mutex_exit(&zp->z_acl_lock);
 2401 
 2402         /* Put the found 'denies' back on the working mode */
 2403         if (deny_mask) {
 2404                 *working_mode |= deny_mask;
 2405                 return (SET_ERROR(EACCES));
 2406         } else if (*working_mode) {
 2407                 return (-1);
 2408         }
 2409 
 2410         return (0);
 2411 }
 2412 
 2413 /*
 2414  * Return true if any access whatsoever granted, we don't actually
 2415  * care what access is granted.
 2416  */
 2417 boolean_t
 2418 zfs_has_access(znode_t *zp, cred_t *cr)
 2419 {
 2420         uint32_t have = ACE_ALL_PERMS;
 2421 
 2422         if (zfs_zaccess_aces_check(zp, &have, B_TRUE, cr,
 2423             kcred->user_ns) != 0) {
 2424                 uid_t owner;
 2425 
 2426                 owner = zfs_fuid_map_id(ZTOZSB(zp),
 2427                     KUID_TO_SUID(ZTOI(zp)->i_uid), cr, ZFS_OWNER);
 2428                 return (secpolicy_vnode_any_access(cr, ZTOI(zp), owner) == 0);
 2429         }
 2430         return (B_TRUE);
 2431 }
 2432 
 2433 /*
 2434  * Simplified access check for case where ACL is known to not contain
 2435  * information beyond what is defined in the mode. In this case, we
 2436  * can pass along to the kernel / vfs generic_permission() check, which
 2437  * evaluates the mode and POSIX ACL.
 2438  *
 2439  * NFSv4 ACLs allow granting permissions that are usually relegated only
 2440  * to the file owner or superuser. Examples are ACE_WRITE_OWNER (chown),
 2441  * ACE_WRITE_ACL(chmod), and ACE_DELETE. ACE_DELETE requests must fail
 2442  * because with conventional posix permissions, right to delete file
 2443  * is determined by write bit on the parent dir.
 2444  *
 2445  * If unmappable perms are requested, then we must return EPERM
 2446  * and include those bits in the working_mode so that the caller of
 2447  * zfs_zaccess_common() can decide whether to perform additional
 2448  * policy / capability checks. EACCES is used in zfs_zaccess_aces_check()
 2449  * to indicate access check failed due to explicit DENY entry, and so
 2450  * we want to avoid that here.
 2451  */
 2452 static int
 2453 zfs_zaccess_trivial(znode_t *zp, uint32_t *working_mode, cred_t *cr,
 2454     zuserns_t *mnt_ns)
 2455 {
 2456         int err, mask;
 2457         int unmapped = 0;
 2458 
 2459         ASSERT(zp->z_pflags & ZFS_ACL_TRIVIAL);
 2460 
 2461         mask = zfs_v4_to_unix(*working_mode, &unmapped);
 2462         if (mask == 0 || unmapped) {
 2463                 *working_mode = unmapped;
 2464                 return (unmapped ? SET_ERROR(EPERM) : 0);
 2465         }
 2466 
 2467 #if defined(HAVE_IOPS_PERMISSION_USERNS)
 2468         if (mnt_ns)
 2469                 err = generic_permission(mnt_ns, ZTOI(zp), mask);
 2470         else
 2471                 err = generic_permission(cr->user_ns, ZTOI(zp), mask);
 2472 #else
 2473         err = generic_permission(ZTOI(zp), mask);
 2474 #endif
 2475         if (err != 0) {
 2476                 return (SET_ERROR(EPERM));
 2477         }
 2478 
 2479         *working_mode = unmapped;
 2480 
 2481         return (0);
 2482 }
 2483 
 2484 static int
 2485 zfs_zaccess_common(znode_t *zp, uint32_t v4_mode, uint32_t *working_mode,
 2486     boolean_t *check_privs, boolean_t skipaclchk, cred_t *cr, zuserns_t *mnt_ns)
 2487 {
 2488         zfsvfs_t *zfsvfs = ZTOZSB(zp);
 2489         int err;
 2490 
 2491         *working_mode = v4_mode;
 2492         *check_privs = B_TRUE;
 2493 
 2494         /*
 2495          * Short circuit empty requests
 2496          */
 2497         if (v4_mode == 0 || zfsvfs->z_replay) {
 2498                 *working_mode = 0;
 2499                 return (0);
 2500         }
 2501 
 2502         if ((err = zfs_zaccess_dataset_check(zp, v4_mode)) != 0) {
 2503                 *check_privs = B_FALSE;
 2504                 return (err);
 2505         }
 2506 
 2507         /*
 2508          * The caller requested that the ACL check be skipped.  This
 2509          * would only happen if the caller checked VOP_ACCESS() with a
 2510          * 32 bit ACE mask and already had the appropriate permissions.
 2511          */
 2512         if (skipaclchk) {
 2513                 *working_mode = 0;
 2514                 return (0);
 2515         }
 2516 
 2517         /*
 2518          * Note: ZFS_READONLY represents the "DOS R/O" attribute.
 2519          * When that flag is set, we should behave as if write access
 2520          * were not granted by anything in the ACL.  In particular:
 2521          * We _must_ allow writes after opening the file r/w, then
 2522          * setting the DOS R/O attribute, and writing some more.
 2523          * (Similar to how you can write after fchmod(fd, 0444).)
 2524          *
 2525          * Therefore ZFS_READONLY is ignored in the dataset check
 2526          * above, and checked here as if part of the ACL check.
 2527          * Also note: DOS R/O is ignored for directories.
 2528          */
 2529         if ((v4_mode & WRITE_MASK_DATA) &&
 2530             S_ISDIR(ZTOI(zp)->i_mode) &&
 2531             (zp->z_pflags & ZFS_READONLY)) {
 2532                 return (SET_ERROR(EPERM));
 2533         }
 2534 
 2535         if (zp->z_pflags & ZFS_ACL_TRIVIAL)
 2536                 return (zfs_zaccess_trivial(zp, working_mode, cr, mnt_ns));
 2537 
 2538         return (zfs_zaccess_aces_check(zp, working_mode, B_FALSE, cr, mnt_ns));
 2539 }
 2540 
 2541 static int
 2542 zfs_zaccess_append(znode_t *zp, uint32_t *working_mode, boolean_t *check_privs,
 2543     cred_t *cr, zuserns_t *mnt_ns)
 2544 {
 2545         if (*working_mode != ACE_WRITE_DATA)
 2546                 return (SET_ERROR(EACCES));
 2547 
 2548         return (zfs_zaccess_common(zp, ACE_APPEND_DATA, working_mode,
 2549             check_privs, B_FALSE, cr, mnt_ns));
 2550 }
 2551 
 2552 int
 2553 zfs_fastaccesschk_execute(znode_t *zdp, cred_t *cr)
 2554 {
 2555         boolean_t owner = B_FALSE;
 2556         boolean_t groupmbr = B_FALSE;
 2557         boolean_t is_attr;
 2558         uid_t uid = crgetuid(cr);
 2559         int error;
 2560 
 2561         if (zdp->z_pflags & ZFS_AV_QUARANTINED)
 2562                 return (SET_ERROR(EACCES));
 2563 
 2564         is_attr = ((zdp->z_pflags & ZFS_XATTR) &&
 2565             (S_ISDIR(ZTOI(zdp)->i_mode)));
 2566         if (is_attr)
 2567                 goto slow;
 2568 
 2569 
 2570         mutex_enter(&zdp->z_acl_lock);
 2571 
 2572         if (zdp->z_pflags & ZFS_NO_EXECS_DENIED) {
 2573                 mutex_exit(&zdp->z_acl_lock);
 2574                 return (0);
 2575         }
 2576 
 2577         if (KUID_TO_SUID(ZTOI(zdp)->i_uid) != 0 ||
 2578             KGID_TO_SGID(ZTOI(zdp)->i_gid) != 0) {
 2579                 mutex_exit(&zdp->z_acl_lock);
 2580                 goto slow;
 2581         }
 2582 
 2583         if (uid == KUID_TO_SUID(ZTOI(zdp)->i_uid)) {
 2584                 if (zdp->z_mode & S_IXUSR) {
 2585                         mutex_exit(&zdp->z_acl_lock);
 2586                         return (0);
 2587                 } else {
 2588                         mutex_exit(&zdp->z_acl_lock);
 2589                         goto slow;
 2590                 }
 2591         }
 2592         if (groupmember(KGID_TO_SGID(ZTOI(zdp)->i_gid), cr)) {
 2593                 if (zdp->z_mode & S_IXGRP) {
 2594                         mutex_exit(&zdp->z_acl_lock);
 2595                         return (0);
 2596                 } else {
 2597                         mutex_exit(&zdp->z_acl_lock);
 2598                         goto slow;
 2599                 }
 2600         }
 2601         if (!owner && !groupmbr) {
 2602                 if (zdp->z_mode & S_IXOTH) {
 2603                         mutex_exit(&zdp->z_acl_lock);
 2604                         return (0);
 2605                 }
 2606         }
 2607 
 2608         mutex_exit(&zdp->z_acl_lock);
 2609 
 2610 slow:
 2611         DTRACE_PROBE(zfs__fastpath__execute__access__miss);
 2612         if ((error = zfs_enter(ZTOZSB(zdp), FTAG)) != 0)
 2613                 return (error);
 2614         error = zfs_zaccess(zdp, ACE_EXECUTE, 0, B_FALSE, cr,
 2615             kcred->user_ns);
 2616         zfs_exit(ZTOZSB(zdp), FTAG);
 2617         return (error);
 2618 }
 2619 
 2620 /*
 2621  * Determine whether Access should be granted/denied.
 2622  *
 2623  * The least priv subsystem is always consulted as a basic privilege
 2624  * can define any form of access.
 2625  */
 2626 int
 2627 zfs_zaccess(znode_t *zp, int mode, int flags, boolean_t skipaclchk, cred_t *cr,
 2628     zuserns_t *mnt_ns)
 2629 {
 2630         uint32_t        working_mode;
 2631         int             error;
 2632         int             is_attr;
 2633         boolean_t       check_privs;
 2634         znode_t         *xzp;
 2635         znode_t         *check_zp = zp;
 2636         mode_t          needed_bits;
 2637         uid_t           owner;
 2638 
 2639         is_attr = ((zp->z_pflags & ZFS_XATTR) && S_ISDIR(ZTOI(zp)->i_mode));
 2640 
 2641         /*
 2642          * If attribute then validate against base file
 2643          */
 2644         if (is_attr) {
 2645                 if ((error = zfs_zget(ZTOZSB(zp),
 2646                     zp->z_xattr_parent, &xzp)) != 0) {
 2647                         return (error);
 2648                 }
 2649 
 2650                 check_zp = xzp;
 2651 
 2652                 /*
 2653                  * fixup mode to map to xattr perms
 2654                  */
 2655 
 2656                 if (mode & (ACE_WRITE_DATA|ACE_APPEND_DATA)) {
 2657                         mode &= ~(ACE_WRITE_DATA|ACE_APPEND_DATA);
 2658                         mode |= ACE_WRITE_NAMED_ATTRS;
 2659                 }
 2660 
 2661                 if (mode & (ACE_READ_DATA|ACE_EXECUTE)) {
 2662                         mode &= ~(ACE_READ_DATA|ACE_EXECUTE);
 2663                         mode |= ACE_READ_NAMED_ATTRS;
 2664                 }
 2665         }
 2666 
 2667         owner = zfs_uid_to_vfsuid(mnt_ns, zfs_i_user_ns(ZTOI(zp)),
 2668             KUID_TO_SUID(ZTOI(zp)->i_uid));
 2669         owner = zfs_fuid_map_id(ZTOZSB(zp), owner, cr, ZFS_OWNER);
 2670 
 2671         /*
 2672          * Map the bits required to the standard inode flags
 2673          * S_IRUSR|S_IWUSR|S_IXUSR in the needed_bits.  Map the bits
 2674          * mapped by working_mode (currently missing) in missing_bits.
 2675          * Call secpolicy_vnode_access2() with (needed_bits & ~checkmode),
 2676          * needed_bits.
 2677          */
 2678         needed_bits = 0;
 2679 
 2680         working_mode = mode;
 2681         if ((working_mode & (ACE_READ_ACL|ACE_READ_ATTRIBUTES)) &&
 2682             owner == crgetuid(cr))
 2683                 working_mode &= ~(ACE_READ_ACL|ACE_READ_ATTRIBUTES);
 2684 
 2685         if (working_mode & (ACE_READ_DATA|ACE_READ_NAMED_ATTRS|
 2686             ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_SYNCHRONIZE))
 2687                 needed_bits |= S_IRUSR;
 2688         if (working_mode & (ACE_WRITE_DATA|ACE_WRITE_NAMED_ATTRS|
 2689             ACE_APPEND_DATA|ACE_WRITE_ATTRIBUTES|ACE_SYNCHRONIZE))
 2690                 needed_bits |= S_IWUSR;
 2691         if (working_mode & ACE_EXECUTE)
 2692                 needed_bits |= S_IXUSR;
 2693 
 2694         if ((error = zfs_zaccess_common(check_zp, mode, &working_mode,
 2695             &check_privs, skipaclchk, cr, mnt_ns)) == 0) {
 2696                 if (is_attr)
 2697                         zrele(xzp);
 2698                 return (secpolicy_vnode_access2(cr, ZTOI(zp), owner,
 2699                     needed_bits, needed_bits));
 2700         }
 2701 
 2702         if (error && !check_privs) {
 2703                 if (is_attr)
 2704                         zrele(xzp);
 2705                 return (error);
 2706         }
 2707 
 2708         if (error && (flags & V_APPEND)) {
 2709                 error = zfs_zaccess_append(zp, &working_mode, &check_privs, cr,
 2710                     mnt_ns);
 2711         }
 2712 
 2713         if (error && check_privs) {
 2714                 mode_t          checkmode = 0;
 2715 
 2716                 /*
 2717                  * First check for implicit owner permission on
 2718                  * read_acl/read_attributes
 2719                  */
 2720 
 2721                 ASSERT(working_mode != 0);
 2722 
 2723                 if ((working_mode & (ACE_READ_ACL|ACE_READ_ATTRIBUTES) &&
 2724                     owner == crgetuid(cr)))
 2725                         working_mode &= ~(ACE_READ_ACL|ACE_READ_ATTRIBUTES);
 2726 
 2727                 if (working_mode & (ACE_READ_DATA|ACE_READ_NAMED_ATTRS|
 2728                     ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_SYNCHRONIZE))
 2729                         checkmode |= S_IRUSR;
 2730                 if (working_mode & (ACE_WRITE_DATA|ACE_WRITE_NAMED_ATTRS|
 2731                     ACE_APPEND_DATA|ACE_WRITE_ATTRIBUTES|ACE_SYNCHRONIZE))
 2732                         checkmode |= S_IWUSR;
 2733                 if (working_mode & ACE_EXECUTE)
 2734                         checkmode |= S_IXUSR;
 2735 
 2736                 error = secpolicy_vnode_access2(cr, ZTOI(check_zp), owner,
 2737                     needed_bits & ~checkmode, needed_bits);
 2738 
 2739                 if (error == 0 && (working_mode & ACE_WRITE_OWNER))
 2740                         error = secpolicy_vnode_chown(cr, owner);
 2741                 if (error == 0 && (working_mode & ACE_WRITE_ACL))
 2742                         error = secpolicy_vnode_setdac(cr, owner);
 2743 
 2744                 if (error == 0 && (working_mode &
 2745                     (ACE_DELETE|ACE_DELETE_CHILD)))
 2746                         error = secpolicy_vnode_remove(cr);
 2747 
 2748                 if (error == 0 && (working_mode & ACE_SYNCHRONIZE)) {
 2749                         error = secpolicy_vnode_chown(cr, owner);
 2750                 }
 2751                 if (error == 0) {
 2752                         /*
 2753                          * See if any bits other than those already checked
 2754                          * for are still present.  If so then return EACCES
 2755                          */
 2756                         if (working_mode & ~(ZFS_CHECKED_MASKS)) {
 2757                                 error = SET_ERROR(EACCES);
 2758                         }
 2759                 }
 2760         } else if (error == 0) {
 2761                 error = secpolicy_vnode_access2(cr, ZTOI(zp), owner,
 2762                     needed_bits, needed_bits);
 2763         }
 2764 
 2765         if (is_attr)
 2766                 zrele(xzp);
 2767 
 2768         return (error);
 2769 }
 2770 
 2771 /*
 2772  * Translate traditional unix S_IRUSR/S_IWUSR/S_IXUSR mode into
 2773  * NFSv4-style ZFS ACL format and call zfs_zaccess()
 2774  */
 2775 int
 2776 zfs_zaccess_rwx(znode_t *zp, mode_t mode, int flags, cred_t *cr,
 2777     zuserns_t *mnt_ns)
 2778 {
 2779         return (zfs_zaccess(zp, zfs_unix_to_v4(mode >> 6), flags, B_FALSE, cr,
 2780             mnt_ns));
 2781 }
 2782 
 2783 /*
 2784  * Access function for secpolicy_vnode_setattr
 2785  */
 2786 int
 2787 zfs_zaccess_unix(void *zp, int mode, cred_t *cr)
 2788 {
 2789         int v4_mode = zfs_unix_to_v4(mode >> 6);
 2790 
 2791         return (zfs_zaccess(zp, v4_mode, 0, B_FALSE, cr, kcred->user_ns));
 2792 }
 2793 
 2794 /* See zfs_zaccess_delete() */
 2795 static const boolean_t zfs_write_implies_delete_child = B_TRUE;
 2796 
 2797 /*
 2798  * Determine whether delete access should be granted.
 2799  *
 2800  * The following chart outlines how we handle delete permissions which is
 2801  * how recent versions of windows (Windows 2008) handles it.  The efficiency
 2802  * comes from not having to check the parent ACL where the object itself grants
 2803  * delete:
 2804  *
 2805  *      -------------------------------------------------------
 2806  *      |   Parent Dir  |      Target Object Permissions      |
 2807  *      |  permissions  |                                     |
 2808  *      -------------------------------------------------------
 2809  *      |               | ACL Allows | ACL Denies| Delete     |
 2810  *      |               |  Delete    |  Delete   | unspecified|
 2811  *      -------------------------------------------------------
 2812  *      | ACL Allows    | Permit     | Deny *    | Permit     |
 2813  *      | DELETE_CHILD  |            |           |            |
 2814  *      -------------------------------------------------------
 2815  *      | ACL Denies    | Permit     | Deny      | Deny       |
 2816  *      | DELETE_CHILD  |            |           |            |
 2817  *      -------------------------------------------------------
 2818  *      | ACL specifies |            |           |            |
 2819  *      | only allow    | Permit     | Deny *    | Permit     |
 2820  *      | write and     |            |           |            |
 2821  *      | execute       |            |           |            |
 2822  *      -------------------------------------------------------
 2823  *      | ACL denies    |            |           |            |
 2824  *      | write and     | Permit     | Deny      | Deny       |
 2825  *      | execute       |            |           |            |
 2826  *      -------------------------------------------------------
 2827  *         ^
 2828  *         |
 2829  *         Re. execute permission on the directory:  if that's missing,
 2830  *         the vnode lookup of the target will fail before we get here.
 2831  *
 2832  * Re [*] in the table above:  NFSv4 would normally Permit delete for
 2833  * these two cells of the matrix.
 2834  * See acl.h for notes on which ACE_... flags should be checked for which
 2835  * operations.  Specifically, the NFSv4 committee recommendation is in
 2836  * conflict with the Windows interpretation of DENY ACEs, where DENY ACEs
 2837  * should take precedence ahead of ALLOW ACEs.
 2838  *
 2839  * This implementation always consults the target object's ACL first.
 2840  * If a DENY ACE is present on the target object that specifies ACE_DELETE,
 2841  * delete access is denied.  If an ALLOW ACE with ACE_DELETE is present on
 2842  * the target object, access is allowed.  If and only if no entries with
 2843  * ACE_DELETE are present in the object's ACL, check the container's ACL
 2844  * for entries with ACE_DELETE_CHILD.
 2845  *
 2846  * A summary of the logic implemented from the table above is as follows:
 2847  *
 2848  * First check for DENY ACEs that apply.
 2849  * If either target or container has a deny, EACCES.
 2850  *
 2851  * Delete access can then be summarized as follows:
 2852  * 1: The object to be deleted grants ACE_DELETE, or
 2853  * 2: The containing directory grants ACE_DELETE_CHILD.
 2854  * In a Windows system, that would be the end of the story.
 2855  * In this system, (2) has some complications...
 2856  * 2a: "sticky" bit on a directory adds restrictions, and
 2857  * 2b: existing ACEs from previous versions of ZFS may
 2858  * not carry ACE_DELETE_CHILD where they should, so we
 2859  * also allow delete when ACE_WRITE_DATA is granted.
 2860  *
 2861  * Note: 2b is technically a work-around for a prior bug,
 2862  * which hopefully can go away some day.  For those who
 2863  * no longer need the work around, and for testing, this
 2864  * work-around is made conditional via the tunable:
 2865  * zfs_write_implies_delete_child
 2866  */
 2867 int
 2868 zfs_zaccess_delete(znode_t *dzp, znode_t *zp, cred_t *cr, zuserns_t *mnt_ns)
 2869 {
 2870         uint32_t wanted_dirperms;
 2871         uint32_t dzp_working_mode = 0;
 2872         uint32_t zp_working_mode = 0;
 2873         int dzp_error, zp_error;
 2874         boolean_t dzpcheck_privs;
 2875         boolean_t zpcheck_privs;
 2876 
 2877         if (zp->z_pflags & (ZFS_IMMUTABLE | ZFS_NOUNLINK))
 2878                 return (SET_ERROR(EPERM));
 2879 
 2880         /*
 2881          * Case 1:
 2882          * If target object grants ACE_DELETE then we are done.  This is
 2883          * indicated by a return value of 0.  For this case we don't worry
 2884          * about the sticky bit because sticky only applies to the parent
 2885          * directory and this is the child access result.
 2886          *
 2887          * If we encounter a DENY ACE here, we're also done (EACCES).
 2888          * Note that if we hit a DENY ACE here (on the target) it should
 2889          * take precedence over a DENY ACE on the container, so that when
 2890          * we have more complete auditing support we will be able to
 2891          * report an access failure against the specific target.
 2892          * (This is part of why we're checking the target first.)
 2893          */
 2894         zp_error = zfs_zaccess_common(zp, ACE_DELETE, &zp_working_mode,
 2895             &zpcheck_privs, B_FALSE, cr, mnt_ns);
 2896         if (zp_error == EACCES) {
 2897                 /* We hit a DENY ACE. */
 2898                 if (!zpcheck_privs)
 2899                         return (SET_ERROR(zp_error));
 2900                 return (secpolicy_vnode_remove(cr));
 2901 
 2902         }
 2903         if (zp_error == 0)
 2904                 return (0);
 2905 
 2906         /*
 2907          * Case 2:
 2908          * If the containing directory grants ACE_DELETE_CHILD,
 2909          * or we're in backward compatibility mode and the
 2910          * containing directory has ACE_WRITE_DATA, allow.
 2911          * Case 2b is handled with wanted_dirperms.
 2912          */
 2913         wanted_dirperms = ACE_DELETE_CHILD;
 2914         if (zfs_write_implies_delete_child)
 2915                 wanted_dirperms |= ACE_WRITE_DATA;
 2916         dzp_error = zfs_zaccess_common(dzp, wanted_dirperms,
 2917             &dzp_working_mode, &dzpcheck_privs, B_FALSE, cr, mnt_ns);
 2918         if (dzp_error == EACCES) {
 2919                 /* We hit a DENY ACE. */
 2920                 if (!dzpcheck_privs)
 2921                         return (SET_ERROR(dzp_error));
 2922                 return (secpolicy_vnode_remove(cr));
 2923         }
 2924 
 2925         /*
 2926          * Cases 2a, 2b (continued)
 2927          *
 2928          * Note: dzp_working_mode now contains any permissions
 2929          * that were NOT granted.  Therefore, if any of the
 2930          * wanted_dirperms WERE granted, we will have:
 2931          *   dzp_working_mode != wanted_dirperms
 2932          * We're really asking if ANY of those permissions
 2933          * were granted, and if so, grant delete access.
 2934          */
 2935         if (dzp_working_mode != wanted_dirperms)
 2936                 dzp_error = 0;
 2937 
 2938         /*
 2939          * dzp_error is 0 if the container granted us permissions to "modify".
 2940          * If we do not have permission via one or more ACEs, our current
 2941          * privileges may still permit us to modify the container.
 2942          *
 2943          * dzpcheck_privs is false when i.e. the FS is read-only.
 2944          * Otherwise, do privilege checks for the container.
 2945          */
 2946         if (dzp_error != 0 && dzpcheck_privs) {
 2947                 uid_t owner;
 2948 
 2949                 /*
 2950                  * The secpolicy call needs the requested access and
 2951                  * the current access mode of the container, but it
 2952                  * only knows about Unix-style modes (VEXEC, VWRITE),
 2953                  * so this must condense the fine-grained ACE bits into
 2954                  * Unix modes.
 2955                  *
 2956                  * The VEXEC flag is easy, because we know that has
 2957                  * always been checked before we get here (during the
 2958                  * lookup of the target vnode).  The container has not
 2959                  * granted us permissions to "modify", so we do not set
 2960                  * the VWRITE flag in the current access mode.
 2961                  */
 2962                 owner = zfs_fuid_map_id(ZTOZSB(dzp),
 2963                     KUID_TO_SUID(ZTOI(dzp)->i_uid), cr, ZFS_OWNER);
 2964                 dzp_error = secpolicy_vnode_access2(cr, ZTOI(dzp),
 2965                     owner, S_IXUSR, S_IWUSR|S_IXUSR);
 2966         }
 2967         if (dzp_error != 0) {
 2968                 /*
 2969                  * Note: We may have dzp_error = -1 here (from
 2970                  * zfs_zacess_common).  Don't return that.
 2971                  */
 2972                 return (SET_ERROR(EACCES));
 2973         }
 2974 
 2975 
 2976         /*
 2977          * At this point, we know that the directory permissions allow
 2978          * us to modify, but we still need to check for the additional
 2979          * restrictions that apply when the "sticky bit" is set.
 2980          *
 2981          * Yes, zfs_sticky_remove_access() also checks this bit, but
 2982          * checking it here and skipping the call below is nice when
 2983          * you're watching all of this with dtrace.
 2984          */
 2985         if ((dzp->z_mode & S_ISVTX) == 0)
 2986                 return (0);
 2987 
 2988         /*
 2989          * zfs_sticky_remove_access will succeed if:
 2990          * 1. The sticky bit is absent.
 2991          * 2. We pass the sticky bit restrictions.
 2992          * 3. We have privileges that always allow file removal.
 2993          */
 2994         return (zfs_sticky_remove_access(dzp, zp, cr));
 2995 }
 2996 
 2997 int
 2998 zfs_zaccess_rename(znode_t *sdzp, znode_t *szp, znode_t *tdzp,
 2999     znode_t *tzp, cred_t *cr, zuserns_t *mnt_ns)
 3000 {
 3001         int add_perm;
 3002         int error;
 3003 
 3004         if (szp->z_pflags & ZFS_AV_QUARANTINED)
 3005                 return (SET_ERROR(EACCES));
 3006 
 3007         add_perm = S_ISDIR(ZTOI(szp)->i_mode) ?
 3008             ACE_ADD_SUBDIRECTORY : ACE_ADD_FILE;
 3009 
 3010         /*
 3011          * Rename permissions are combination of delete permission +
 3012          * add file/subdir permission.
 3013          */
 3014 
 3015         /*
 3016          * first make sure we do the delete portion.
 3017          *
 3018          * If that succeeds then check for add_file/add_subdir permissions
 3019          */
 3020 
 3021         if ((error = zfs_zaccess_delete(sdzp, szp, cr, mnt_ns)))
 3022                 return (error);
 3023 
 3024         /*
 3025          * If we have a tzp, see if we can delete it?
 3026          */
 3027         if (tzp) {
 3028                 if ((error = zfs_zaccess_delete(tdzp, tzp, cr, mnt_ns)))
 3029                         return (error);
 3030         }
 3031 
 3032         /*
 3033          * Now check for add permissions
 3034          */
 3035         error = zfs_zaccess(tdzp, add_perm, 0, B_FALSE, cr, mnt_ns);
 3036 
 3037         return (error);
 3038 }
Cache object: f778bc5d0f10a7cf080d0d23522355f2
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.
FreeBSD/Linux Kernel Cross Reference sys/contrib/openzfs/module/os/linux/zfs/zfs_acl.c

FreeBSD/Linux Kernel Cross Reference
sys/contrib/openzfs/module/os/linux/zfs/zfs_acl.c
