Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
FreeBSD/Linux Kernel Cross Reference
sys/kern/vfs_lookup.c
Version:
- FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
SearchContext: - none - 3 - 10
1 /*- 2 * Copyright (c) 1982, 1986, 1989, 1993 3 * The Regents of the University of California. All rights reserved. 4 * (c) UNIX System Laboratories, Inc. 5 * All or some portions of this file are derived from material licensed 6 * to the University of California by American Telephone and Telegraph 7 * Co. or Unix System Laboratories, Inc. and are reproduced herein with 8 * the permission of UNIX System Laboratories, Inc. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 4. Neither the name of the University nor the names of its contributors 19 * may be used to endorse or promote products derived from this software 20 * without specific prior written permission. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32 * SUCH DAMAGE. 33 * 34 * @(#)vfs_lookup.c 8.4 (Berkeley) 2/16/94 35 */ 36 37 #include <sys/cdefs.h> 38 __FBSDID("$FreeBSD$"); 39 40 #include "opt_capsicum.h" 41 #include "opt_ktrace.h" 42 43 #include <sys/param.h> 44 #include <sys/systm.h> 45 #include <sys/kernel.h> 46 #include <sys/capsicum.h> 47 #include <sys/fcntl.h> 48 #include <sys/jail.h> 49 #include <sys/lock.h> 50 #include <sys/mutex.h> 51 #include <sys/namei.h> 52 #include <sys/vnode.h> 53 #include <sys/mount.h> 54 #include <sys/filedesc.h> 55 #include <sys/proc.h> 56 #include <sys/sdt.h> 57 #include <sys/syscallsubr.h> 58 #include <sys/sysctl.h> 59 #ifdef KTRACE 60 #include <sys/ktrace.h> 61 #endif 62 63 #include <security/audit/audit.h> 64 #include <security/mac/mac_framework.h> 65 66 #include <vm/uma.h> 67 68 #define NAMEI_DIAGNOSTIC 1 69 #undef NAMEI_DIAGNOSTIC 70 71 SDT_PROVIDER_DECLARE(vfs); 72 SDT_PROBE_DEFINE3(vfs, namei, lookup, entry, "struct vnode *", "char *", 73 "unsigned long"); 74 SDT_PROBE_DEFINE2(vfs, namei, lookup, return, "int", "struct vnode *"); 75 76 /* Allocation zone for namei. */ 77 uma_zone_t namei_zone; 78 79 /* Placeholder vnode for mp traversal. */ 80 static struct vnode *vp_crossmp; 81 82 static int 83 crossmp_vop_islocked(struct vop_islocked_args *ap) 84 { 85 86 return (LK_SHARED); 87 } 88 89 static int 90 crossmp_vop_lock1(struct vop_lock1_args *ap) 91 { 92 struct vnode *vp; 93 struct lock *lk; 94 const char *file; 95 int flags, line; 96 97 vp = ap->a_vp; 98 lk = vp->v_vnlock; 99 flags = ap->a_flags; 100 file = ap->a_file; 101 line = ap->a_line; 102 103 if ((flags & LK_SHARED) == 0) 104 panic("invalid lock request for crossmp"); 105 106 WITNESS_CHECKORDER(&lk->lock_object, LOP_NEWORDER, file, line, 107 flags & LK_INTERLOCK ? &VI_MTX(vp)->lock_object : NULL); 108 WITNESS_LOCK(&lk->lock_object, 0, file, line); 109 if ((flags & LK_INTERLOCK) != 0) 110 VI_UNLOCK(vp); 111 LOCK_LOG_LOCK("SLOCK", &lk->lock_object, 0, 0, ap->a_file, line); 112 return (0); 113 } 114 115 static int 116 crossmp_vop_unlock(struct vop_unlock_args *ap) 117 { 118 struct vnode *vp; 119 struct lock *lk; 120 int flags; 121 122 vp = ap->a_vp; 123 lk = vp->v_vnlock; 124 flags = ap->a_flags; 125 126 if ((flags & LK_INTERLOCK) != 0) 127 VI_UNLOCK(vp); 128 WITNESS_UNLOCK(&lk->lock_object, 0, LOCK_FILE, LOCK_LINE); 129 LOCK_LOG_LOCK("SUNLOCK", &lk->lock_object, 0, 0, LOCK_FILE, 130 LOCK_LINE); 131 return (0); 132 } 133 134 static struct vop_vector crossmp_vnodeops = { 135 .vop_default = &default_vnodeops, 136 .vop_islocked = crossmp_vop_islocked, 137 .vop_lock1 = crossmp_vop_lock1, 138 .vop_unlock = crossmp_vop_unlock, 139 }; 140 141 struct nameicap_tracker { 142 struct vnode *dp; 143 TAILQ_ENTRY(nameicap_tracker) nm_link; 144 }; 145 146 /* Zone for cap mode tracker elements used for dotdot capability checks. */ 147 static uma_zone_t nt_zone; 148 149 static void 150 nameiinit(void *dummy __unused) 151 { 152 153 namei_zone = uma_zcreate("NAMEI", MAXPATHLEN, NULL, NULL, NULL, NULL, 154 UMA_ALIGN_PTR, 0); 155 nt_zone = uma_zcreate("rentr", sizeof(struct nameicap_tracker), 156 NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0); 157 getnewvnode("crossmp", NULL, &crossmp_vnodeops, &vp_crossmp); 158 } 159 SYSINIT(vfs, SI_SUB_VFS, SI_ORDER_SECOND, nameiinit, NULL); 160 161 static int lookup_shared = 1; 162 SYSCTL_INT(_vfs, OID_AUTO, lookup_shared, CTLFLAG_RWTUN, &lookup_shared, 0, 163 "enables shared locks for path name translation"); 164 165 static int lookup_cap_dotdot = 1; 166 SYSCTL_INT(_vfs, OID_AUTO, lookup_cap_dotdot, CTLFLAG_RWTUN, 167 &lookup_cap_dotdot, 0, 168 "enables \"..\" components in path lookup in capability mode"); 169 static int lookup_cap_dotdot_nonlocal = 1; 170 SYSCTL_INT(_vfs, OID_AUTO, lookup_cap_dotdot_nonlocal, CTLFLAG_RWTUN, 171 &lookup_cap_dotdot_nonlocal, 0, 172 "enables \"..\" components in path lookup in capability mode " 173 "on non-local mount"); 174 175 static void 176 nameicap_tracker_add(struct nameidata *ndp, struct vnode *dp) 177 { 178 struct nameicap_tracker *nt; 179 180 if ((ndp->ni_lcf & NI_LCF_CAP_DOTDOT) == 0 || dp->v_type != VDIR) 181 return; 182 nt = uma_zalloc(nt_zone, M_WAITOK); 183 vhold(dp); 184 nt->dp = dp; 185 TAILQ_INSERT_TAIL(&ndp->ni_cap_tracker, nt, nm_link); 186 } 187 188 static void 189 nameicap_cleanup(struct nameidata *ndp) 190 { 191 struct nameicap_tracker *nt, *nt1; 192 193 KASSERT(TAILQ_EMPTY(&ndp->ni_cap_tracker) || 194 (ndp->ni_lcf & NI_LCF_CAP_DOTDOT) != 0, ("not strictrelative")); 195 TAILQ_FOREACH_SAFE(nt, &ndp->ni_cap_tracker, nm_link, nt1) { 196 TAILQ_REMOVE(&ndp->ni_cap_tracker, nt, nm_link); 197 vdrop(nt->dp); 198 uma_zfree(nt_zone, nt); 199 } 200 } 201 202 /* 203 * For dotdot lookups in capability mode, only allow the component 204 * lookup to succeed if the resulting directory was already traversed 205 * during the operation. Also fail dotdot lookups for non-local 206 * filesystems, where external agents might assist local lookups to 207 * escape the compartment. 208 */ 209 static int 210 nameicap_check_dotdot(struct nameidata *ndp, struct vnode *dp) 211 { 212 struct nameicap_tracker *nt; 213 struct mount *mp; 214 215 if ((ndp->ni_lcf & NI_LCF_CAP_DOTDOT) == 0 || dp == NULL || 216 dp->v_type != VDIR) 217 return (0); 218 mp = dp->v_mount; 219 if (lookup_cap_dotdot_nonlocal == 0 && mp != NULL && 220 (mp->mnt_flag & MNT_LOCAL) == 0) 221 return (ENOTCAPABLE); 222 TAILQ_FOREACH_REVERSE(nt, &ndp->ni_cap_tracker, nameicap_tracker_head, 223 nm_link) { 224 if (dp == nt->dp) 225 return (0); 226 } 227 return (ENOTCAPABLE); 228 } 229 230 static void 231 namei_cleanup_cnp(struct componentname *cnp) 232 { 233 234 uma_zfree(namei_zone, cnp->cn_pnbuf); 235 #ifdef DIAGNOSTIC 236 cnp->cn_pnbuf = NULL; 237 cnp->cn_nameptr = NULL; 238 #endif 239 } 240 241 static int 242 namei_handle_root(struct nameidata *ndp, struct vnode **dpp) 243 { 244 struct componentname *cnp; 245 246 cnp = &ndp->ni_cnd; 247 if ((ndp->ni_lcf & NI_LCF_STRICTRELATIVE) != 0) { 248 #ifdef KTRACE 249 if (KTRPOINT(curthread, KTR_CAPFAIL)) 250 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 251 #endif 252 return (ENOTCAPABLE); 253 } 254 while (*(cnp->cn_nameptr) == '/') { 255 cnp->cn_nameptr++; 256 ndp->ni_pathlen--; 257 } 258 *dpp = ndp->ni_rootdir; 259 vrefact(*dpp); 260 return (0); 261 } 262 263 /* 264 * Convert a pathname into a pointer to a locked vnode. 265 * 266 * The FOLLOW flag is set when symbolic links are to be followed 267 * when they occur at the end of the name translation process. 268 * Symbolic links are always followed for all other pathname 269 * components other than the last. 270 * 271 * The segflg defines whether the name is to be copied from user 272 * space or kernel space. 273 * 274 * Overall outline of namei: 275 * 276 * copy in name 277 * get starting directory 278 * while (!done && !error) { 279 * call lookup to search path. 280 * if symbolic link, massage name in buffer and continue 281 * } 282 */ 283 int 284 namei(struct nameidata *ndp) 285 { 286 struct filedesc *fdp; /* pointer to file descriptor state */ 287 char *cp; /* pointer into pathname argument */ 288 struct vnode *dp; /* the directory we are searching */ 289 struct iovec aiov; /* uio for reading symbolic links */ 290 struct componentname *cnp; 291 struct file *dfp; 292 struct thread *td; 293 struct proc *p; 294 cap_rights_t rights; 295 struct uio auio; 296 int error, linklen, startdir_used; 297 298 cnp = &ndp->ni_cnd; 299 td = cnp->cn_thread; 300 p = td->td_proc; 301 ndp->ni_cnd.cn_cred = ndp->ni_cnd.cn_thread->td_ucred; 302 KASSERT(cnp->cn_cred && p, ("namei: bad cred/proc")); 303 KASSERT((cnp->cn_nameiop & (~OPMASK)) == 0, 304 ("namei: nameiop contaminated with flags")); 305 KASSERT((cnp->cn_flags & OPMASK) == 0, 306 ("namei: flags contaminated with nameiops")); 307 MPASS(ndp->ni_startdir == NULL || ndp->ni_startdir->v_type == VDIR || 308 ndp->ni_startdir->v_type == VBAD); 309 if (!lookup_shared) 310 cnp->cn_flags &= ~LOCKSHARED; 311 fdp = p->p_fd; 312 TAILQ_INIT(&ndp->ni_cap_tracker); 313 ndp->ni_lcf = 0; 314 315 /* We will set this ourselves if we need it. */ 316 cnp->cn_flags &= ~TRAILINGSLASH; 317 318 /* 319 * Get a buffer for the name to be translated, and copy the 320 * name into the buffer. 321 */ 322 if ((cnp->cn_flags & HASBUF) == 0) 323 cnp->cn_pnbuf = uma_zalloc(namei_zone, M_WAITOK); 324 if (ndp->ni_segflg == UIO_SYSSPACE) 325 error = copystr(ndp->ni_dirp, cnp->cn_pnbuf, MAXPATHLEN, 326 &ndp->ni_pathlen); 327 else 328 error = copyinstr(ndp->ni_dirp, cnp->cn_pnbuf, MAXPATHLEN, 329 &ndp->ni_pathlen); 330 331 /* 332 * Don't allow empty pathnames. 333 */ 334 if (error == 0 && *cnp->cn_pnbuf == '\0') 335 error = ENOENT; 336 337 #ifdef CAPABILITY_MODE 338 /* 339 * In capability mode, lookups must be restricted to happen in 340 * the subtree with the root specified by the file descriptor: 341 * - The root must be real file descriptor, not the pseudo-descriptor 342 * AT_FDCWD. 343 * - The passed path must be relative and not absolute. 344 * - If lookup_cap_dotdot is disabled, path must not contain the 345 * '..' components. 346 * - If lookup_cap_dotdot is enabled, we verify that all '..' 347 * components lookups result in the directories which were 348 * previously walked by us, which prevents an escape from 349 * the relative root. 350 */ 351 if (error == 0 && IN_CAPABILITY_MODE(td) && 352 (cnp->cn_flags & NOCAPCHECK) == 0) { 353 ndp->ni_lcf |= NI_LCF_STRICTRELATIVE; 354 if (ndp->ni_dirfd == AT_FDCWD) { 355 #ifdef KTRACE 356 if (KTRPOINT(td, KTR_CAPFAIL)) 357 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 358 #endif 359 error = ECAPMODE; 360 } 361 } 362 #endif 363 if (error != 0) { 364 namei_cleanup_cnp(cnp); 365 ndp->ni_vp = NULL; 366 return (error); 367 } 368 ndp->ni_loopcnt = 0; 369 #ifdef KTRACE 370 if (KTRPOINT(td, KTR_NAMEI)) { 371 KASSERT(cnp->cn_thread == curthread, 372 ("namei not using curthread")); 373 ktrnamei(cnp->cn_pnbuf); 374 } 375 #endif 376 /* 377 * Get starting point for the translation. 378 */ 379 FILEDESC_SLOCK(fdp); 380 ndp->ni_rootdir = fdp->fd_rdir; 381 vrefact(ndp->ni_rootdir); 382 ndp->ni_topdir = fdp->fd_jdir; 383 384 /* 385 * If we are auditing the kernel pathname, save the user pathname. 386 */ 387 if (cnp->cn_flags & AUDITVNODE1) 388 AUDIT_ARG_UPATH1(td, ndp->ni_dirfd, cnp->cn_pnbuf); 389 if (cnp->cn_flags & AUDITVNODE2) 390 AUDIT_ARG_UPATH2(td, ndp->ni_dirfd, cnp->cn_pnbuf); 391 392 startdir_used = 0; 393 dp = NULL; 394 cnp->cn_nameptr = cnp->cn_pnbuf; 395 if (cnp->cn_pnbuf[0] == '/') { 396 error = namei_handle_root(ndp, &dp); 397 } else { 398 if (ndp->ni_startdir != NULL) { 399 dp = ndp->ni_startdir; 400 startdir_used = 1; 401 } else if (ndp->ni_dirfd == AT_FDCWD) { 402 dp = fdp->fd_cdir; 403 vrefact(dp); 404 } else { 405 rights = ndp->ni_rightsneeded; 406 cap_rights_set(&rights, CAP_LOOKUP); 407 408 if (cnp->cn_flags & AUDITVNODE1) 409 AUDIT_ARG_ATFD1(ndp->ni_dirfd); 410 if (cnp->cn_flags & AUDITVNODE2) 411 AUDIT_ARG_ATFD2(ndp->ni_dirfd); 412 /* 413 * Effectively inlined fgetvp_rights, because we need to 414 * inspect the file as well as grabbing the vnode. 415 */ 416 error = fget_cap_locked(fdp, ndp->ni_dirfd, &rights, 417 &dfp, &ndp->ni_filecaps); 418 if (error != 0) { 419 /* 420 * Preserve the error; it should either be EBADF 421 * or capability-related, both of which can be 422 * safely returned to the caller. 423 */ 424 } else if (dfp->f_ops == &badfileops) { 425 error = EBADF; 426 } else if (dfp->f_vnode == NULL) { 427 error = ENOTDIR; 428 } else { 429 dp = dfp->f_vnode; 430 vrefact(dp); 431 432 if ((dfp->f_flag & FSEARCH) != 0) 433 cnp->cn_flags |= NOEXECCHECK; 434 } 435 #ifdef CAPABILITIES 436 /* 437 * If file descriptor doesn't have all rights, 438 * all lookups relative to it must also be 439 * strictly relative. 440 */ 441 CAP_ALL(&rights); 442 if (!cap_rights_contains(&ndp->ni_filecaps.fc_rights, 443 &rights) || 444 ndp->ni_filecaps.fc_fcntls != CAP_FCNTL_ALL || 445 ndp->ni_filecaps.fc_nioctls != -1) { 446 ndp->ni_lcf |= NI_LCF_STRICTRELATIVE; 447 } 448 #endif 449 } 450 if (error == 0 && dp->v_type != VDIR) 451 error = ENOTDIR; 452 } 453 FILEDESC_SUNLOCK(fdp); 454 if (ndp->ni_startdir != NULL && !startdir_used) 455 vrele(ndp->ni_startdir); 456 if (error != 0) { 457 if (dp != NULL) 458 vrele(dp); 459 goto out; 460 } 461 if ((ndp->ni_lcf & NI_LCF_STRICTRELATIVE) != 0 && 462 lookup_cap_dotdot != 0) 463 ndp->ni_lcf |= NI_LCF_CAP_DOTDOT; 464 SDT_PROBE3(vfs, namei, lookup, entry, dp, cnp->cn_pnbuf, 465 cnp->cn_flags); 466 for (;;) { 467 ndp->ni_startdir = dp; 468 error = lookup(ndp); 469 if (error != 0) 470 goto out; 471 /* 472 * If not a symbolic link, we're done. 473 */ 474 if ((cnp->cn_flags & ISSYMLINK) == 0) { 475 vrele(ndp->ni_rootdir); 476 if ((cnp->cn_flags & (SAVENAME | SAVESTART)) == 0) { 477 namei_cleanup_cnp(cnp); 478 } else 479 cnp->cn_flags |= HASBUF; 480 nameicap_cleanup(ndp); 481 SDT_PROBE2(vfs, namei, lookup, return, 0, ndp->ni_vp); 482 return (0); 483 } 484 if (ndp->ni_loopcnt++ >= MAXSYMLINKS) { 485 error = ELOOP; 486 break; 487 } 488 #ifdef MAC 489 if ((cnp->cn_flags & NOMACCHECK) == 0) { 490 error = mac_vnode_check_readlink(td->td_ucred, 491 ndp->ni_vp); 492 if (error != 0) 493 break; 494 } 495 #endif 496 if (ndp->ni_pathlen > 1) 497 cp = uma_zalloc(namei_zone, M_WAITOK); 498 else 499 cp = cnp->cn_pnbuf; 500 aiov.iov_base = cp; 501 aiov.iov_len = MAXPATHLEN; 502 auio.uio_iov = &aiov; 503 auio.uio_iovcnt = 1; 504 auio.uio_offset = 0; 505 auio.uio_rw = UIO_READ; 506 auio.uio_segflg = UIO_SYSSPACE; 507 auio.uio_td = td; 508 auio.uio_resid = MAXPATHLEN; 509 error = VOP_READLINK(ndp->ni_vp, &auio, cnp->cn_cred); 510 if (error != 0) { 511 if (ndp->ni_pathlen > 1) 512 uma_zfree(namei_zone, cp); 513 break; 514 } 515 linklen = MAXPATHLEN - auio.uio_resid; 516 if (linklen == 0) { 517 if (ndp->ni_pathlen > 1) 518 uma_zfree(namei_zone, cp); 519 error = ENOENT; 520 break; 521 } 522 if (linklen + ndp->ni_pathlen >= MAXPATHLEN) { 523 if (ndp->ni_pathlen > 1) 524 uma_zfree(namei_zone, cp); 525 error = ENAMETOOLONG; 526 break; 527 } 528 if (ndp->ni_pathlen > 1) { 529 bcopy(ndp->ni_next, cp + linklen, ndp->ni_pathlen); 530 uma_zfree(namei_zone, cnp->cn_pnbuf); 531 cnp->cn_pnbuf = cp; 532 } else 533 cnp->cn_pnbuf[linklen] = '\0'; 534 ndp->ni_pathlen += linklen; 535 vput(ndp->ni_vp); 536 dp = ndp->ni_dvp; 537 /* 538 * Check if root directory should replace current directory. 539 */ 540 cnp->cn_nameptr = cnp->cn_pnbuf; 541 if (*(cnp->cn_nameptr) == '/') { 542 vrele(dp); 543 error = namei_handle_root(ndp, &dp); 544 if (error != 0) 545 goto out; 546 } 547 } 548 vput(ndp->ni_vp); 549 ndp->ni_vp = NULL; 550 vrele(ndp->ni_dvp); 551 out: 552 vrele(ndp->ni_rootdir); 553 namei_cleanup_cnp(cnp); 554 nameicap_cleanup(ndp); 555 SDT_PROBE2(vfs, namei, lookup, return, error, NULL); 556 return (error); 557 } 558 559 static int 560 compute_cn_lkflags(struct mount *mp, int lkflags, int cnflags) 561 { 562 563 if (mp == NULL || ((lkflags & LK_SHARED) && 564 (!(mp->mnt_kern_flag & MNTK_LOOKUP_SHARED) || 565 ((cnflags & ISDOTDOT) && 566 (mp->mnt_kern_flag & MNTK_LOOKUP_EXCL_DOTDOT))))) { 567 lkflags &= ~LK_SHARED; 568 lkflags |= LK_EXCLUSIVE; 569 } 570 lkflags |= LK_NODDLKTREAT; 571 return (lkflags); 572 } 573 574 static __inline int 575 needs_exclusive_leaf(struct mount *mp, int flags) 576 { 577 578 /* 579 * Intermediate nodes can use shared locks, we only need to 580 * force an exclusive lock for leaf nodes. 581 */ 582 if ((flags & (ISLASTCN | LOCKLEAF)) != (ISLASTCN | LOCKLEAF)) 583 return (0); 584 585 /* Always use exclusive locks if LOCKSHARED isn't set. */ 586 if (!(flags & LOCKSHARED)) 587 return (1); 588 589 /* 590 * For lookups during open(), if the mount point supports 591 * extended shared operations, then use a shared lock for the 592 * leaf node, otherwise use an exclusive lock. 593 */ 594 if ((flags & ISOPEN) != 0) 595 return (!MNT_EXTENDED_SHARED(mp)); 596 597 /* 598 * Lookup requests outside of open() that specify LOCKSHARED 599 * only need a shared lock on the leaf vnode. 600 */ 601 return (0); 602 } 603 604 /* 605 * Search a pathname. 606 * This is a very central and rather complicated routine. 607 * 608 * The pathname is pointed to by ni_ptr and is of length ni_pathlen. 609 * The starting directory is taken from ni_startdir. The pathname is 610 * descended until done, or a symbolic link is encountered. The variable 611 * ni_more is clear if the path is completed; it is set to one if a 612 * symbolic link needing interpretation is encountered. 613 * 614 * The flag argument is LOOKUP, CREATE, RENAME, or DELETE depending on 615 * whether the name is to be looked up, created, renamed, or deleted. 616 * When CREATE, RENAME, or DELETE is specified, information usable in 617 * creating, renaming, or deleting a directory entry may be calculated. 618 * If flag has LOCKPARENT or'ed into it, the parent directory is returned 619 * locked. If flag has WANTPARENT or'ed into it, the parent directory is 620 * returned unlocked. Otherwise the parent directory is not returned. If 621 * the target of the pathname exists and LOCKLEAF is or'ed into the flag 622 * the target is returned locked, otherwise it is returned unlocked. 623 * When creating or renaming and LOCKPARENT is specified, the target may not 624 * be ".". When deleting and LOCKPARENT is specified, the target may be ".". 625 * 626 * Overall outline of lookup: 627 * 628 * dirloop: 629 * identify next component of name at ndp->ni_ptr 630 * handle degenerate case where name is null string 631 * if .. and crossing mount points and on mounted filesys, find parent 632 * call VOP_LOOKUP routine for next component name 633 * directory vnode returned in ni_dvp, unlocked unless LOCKPARENT set 634 * component vnode returned in ni_vp (if it exists), locked. 635 * if result vnode is mounted on and crossing mount points, 636 * find mounted on vnode 637 * if more components of name, do next level at dirloop 638 * return the answer in ni_vp, locked if LOCKLEAF set 639 * if LOCKPARENT set, return locked parent in ni_dvp 640 * if WANTPARENT set, return unlocked parent in ni_dvp 641 */ 642 int 643 lookup(struct nameidata *ndp) 644 { 645 char *cp; /* pointer into pathname argument */ 646 char *prev_ni_next; /* saved ndp->ni_next */ 647 struct vnode *dp = NULL; /* the directory we are searching */ 648 struct vnode *tdp; /* saved dp */ 649 struct mount *mp; /* mount table entry */ 650 struct prison *pr; 651 size_t prev_ni_pathlen; /* saved ndp->ni_pathlen */ 652 int docache; /* == 0 do not cache last component */ 653 int wantparent; /* 1 => wantparent or lockparent flag */ 654 int rdonly; /* lookup read-only flag bit */ 655 int error = 0; 656 int dpunlocked = 0; /* dp has already been unlocked */ 657 int relookup = 0; /* do not consume the path component */ 658 struct componentname *cnp = &ndp->ni_cnd; 659 int lkflags_save; 660 int ni_dvp_unlocked; 661 662 /* 663 * Setup: break out flag bits into variables. 664 */ 665 ni_dvp_unlocked = 0; 666 wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT); 667 KASSERT(cnp->cn_nameiop == LOOKUP || wantparent, 668 ("CREATE, DELETE, RENAME require LOCKPARENT or WANTPARENT.")); 669 docache = (cnp->cn_flags & NOCACHE) ^ NOCACHE; 670 if (cnp->cn_nameiop == DELETE || 671 (wantparent && cnp->cn_nameiop != CREATE && 672 cnp->cn_nameiop != LOOKUP)) 673 docache = 0; 674 rdonly = cnp->cn_flags & RDONLY; 675 cnp->cn_flags &= ~ISSYMLINK; 676 ndp->ni_dvp = NULL; 677 /* 678 * We use shared locks until we hit the parent of the last cn then 679 * we adjust based on the requesting flags. 680 */ 681 if (lookup_shared) 682 cnp->cn_lkflags = LK_SHARED; 683 else 684 cnp->cn_lkflags = LK_EXCLUSIVE; 685 dp = ndp->ni_startdir; 686 ndp->ni_startdir = NULLVP; 687 vn_lock(dp, 688 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | LK_RETRY, 689 cnp->cn_flags)); 690 691 dirloop: 692 /* 693 * Search a new directory. 694 * 695 * The last component of the filename is left accessible via 696 * cnp->cn_nameptr for callers that need the name. Callers needing 697 * the name set the SAVENAME flag. When done, they assume 698 * responsibility for freeing the pathname buffer. 699 */ 700 for (cp = cnp->cn_nameptr; *cp != 0 && *cp != '/'; cp++) 701 continue; 702 cnp->cn_namelen = cp - cnp->cn_nameptr; 703 if (cnp->cn_namelen > NAME_MAX) { 704 error = ENAMETOOLONG; 705 goto bad; 706 } 707 #ifdef NAMEI_DIAGNOSTIC 708 { char c = *cp; 709 *cp = '\0'; 710 printf("{%s}: ", cnp->cn_nameptr); 711 *cp = c; } 712 #endif 713 prev_ni_pathlen = ndp->ni_pathlen; 714 ndp->ni_pathlen -= cnp->cn_namelen; 715 KASSERT(ndp->ni_pathlen <= PATH_MAX, 716 ("%s: ni_pathlen underflow to %zd\n", __func__, ndp->ni_pathlen)); 717 prev_ni_next = ndp->ni_next; 718 ndp->ni_next = cp; 719 720 /* 721 * Replace multiple slashes by a single slash and trailing slashes 722 * by a null. This must be done before VOP_LOOKUP() because some 723 * fs's don't know about trailing slashes. Remember if there were 724 * trailing slashes to handle symlinks, existing non-directories 725 * and non-existing files that won't be directories specially later. 726 */ 727 while (*cp == '/' && (cp[1] == '/' || cp[1] == '\0')) { 728 cp++; 729 ndp->ni_pathlen--; 730 if (*cp == '\0') { 731 *ndp->ni_next = '\0'; 732 cnp->cn_flags |= TRAILINGSLASH; 733 } 734 } 735 ndp->ni_next = cp; 736 737 cnp->cn_flags |= MAKEENTRY; 738 if (*cp == '\0' && docache == 0) 739 cnp->cn_flags &= ~MAKEENTRY; 740 if (cnp->cn_namelen == 2 && 741 cnp->cn_nameptr[1] == '.' && cnp->cn_nameptr[0] == '.') 742 cnp->cn_flags |= ISDOTDOT; 743 else 744 cnp->cn_flags &= ~ISDOTDOT; 745 if (*ndp->ni_next == 0) 746 cnp->cn_flags |= ISLASTCN; 747 else 748 cnp->cn_flags &= ~ISLASTCN; 749 750 if ((cnp->cn_flags & ISLASTCN) != 0 && 751 cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.' && 752 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 753 error = EINVAL; 754 goto bad; 755 } 756 757 nameicap_tracker_add(ndp, dp); 758 759 /* 760 * Check for degenerate name (e.g. / or "") 761 * which is a way of talking about a directory, 762 * e.g. like "/." or ".". 763 */ 764 if (cnp->cn_nameptr[0] == '\0') { 765 if (dp->v_type != VDIR) { 766 error = ENOTDIR; 767 goto bad; 768 } 769 if (cnp->cn_nameiop != LOOKUP) { 770 error = EISDIR; 771 goto bad; 772 } 773 if (wantparent) { 774 ndp->ni_dvp = dp; 775 VREF(dp); 776 } 777 ndp->ni_vp = dp; 778 779 if (cnp->cn_flags & AUDITVNODE1) 780 AUDIT_ARG_VNODE1(dp); 781 else if (cnp->cn_flags & AUDITVNODE2) 782 AUDIT_ARG_VNODE2(dp); 783 784 if (!(cnp->cn_flags & (LOCKPARENT | LOCKLEAF))) 785 VOP_UNLOCK(dp, 0); 786 /* XXX This should probably move to the top of function. */ 787 if (cnp->cn_flags & SAVESTART) 788 panic("lookup: SAVESTART"); 789 goto success; 790 } 791 792 /* 793 * Handle "..": five special cases. 794 * 0. If doing a capability lookup and lookup_cap_dotdot is 795 * disabled, return ENOTCAPABLE. 796 * 1. Return an error if this is the last component of 797 * the name and the operation is DELETE or RENAME. 798 * 2. If at root directory (e.g. after chroot) 799 * or at absolute root directory 800 * then ignore it so can't get out. 801 * 3. If this vnode is the root of a mounted 802 * filesystem, then replace it with the 803 * vnode which was mounted on so we take the 804 * .. in the other filesystem. 805 * 4. If the vnode is the top directory of 806 * the jail or chroot, don't let them out. 807 * 5. If doing a capability lookup and lookup_cap_dotdot is 808 * enabled, return ENOTCAPABLE if the lookup would escape 809 * from the initial file descriptor directory. Checks are 810 * done by ensuring that namei() already traversed the 811 * result of dotdot lookup. 812 */ 813 if (cnp->cn_flags & ISDOTDOT) { 814 if ((ndp->ni_lcf & (NI_LCF_STRICTRELATIVE | NI_LCF_CAP_DOTDOT)) 815 == NI_LCF_STRICTRELATIVE) { 816 #ifdef KTRACE 817 if (KTRPOINT(curthread, KTR_CAPFAIL)) 818 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 819 #endif 820 error = ENOTCAPABLE; 821 goto bad; 822 } 823 if ((cnp->cn_flags & ISLASTCN) != 0 && 824 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 825 error = EINVAL; 826 goto bad; 827 } 828 for (;;) { 829 for (pr = cnp->cn_cred->cr_prison; pr != NULL; 830 pr = pr->pr_parent) 831 if (dp == pr->pr_root) 832 break; 833 if (dp == ndp->ni_rootdir || 834 dp == ndp->ni_topdir || 835 dp == rootvnode || 836 pr != NULL || 837 ((dp->v_vflag & VV_ROOT) != 0 && 838 (cnp->cn_flags & NOCROSSMOUNT) != 0)) { 839 ndp->ni_dvp = dp; 840 ndp->ni_vp = dp; 841 VREF(dp); 842 goto nextname; 843 } 844 if ((dp->v_vflag & VV_ROOT) == 0) 845 break; 846 if (dp->v_iflag & VI_DOOMED) { /* forced unmount */ 847 error = ENOENT; 848 goto bad; 849 } 850 tdp = dp; 851 dp = dp->v_mount->mnt_vnodecovered; 852 VREF(dp); 853 vput(tdp); 854 vn_lock(dp, 855 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | 856 LK_RETRY, ISDOTDOT)); 857 error = nameicap_check_dotdot(ndp, dp); 858 if (error != 0) { 859 #ifdef KTRACE 860 if (KTRPOINT(curthread, KTR_CAPFAIL)) 861 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 862 #endif 863 goto bad; 864 } 865 } 866 } 867 868 /* 869 * We now have a segment name to search for, and a directory to search. 870 */ 871 unionlookup: 872 #ifdef MAC 873 if ((cnp->cn_flags & NOMACCHECK) == 0) { 874 error = mac_vnode_check_lookup(cnp->cn_thread->td_ucred, dp, 875 cnp); 876 if (error) 877 goto bad; 878 } 879 #endif 880 ndp->ni_dvp = dp; 881 ndp->ni_vp = NULL; 882 ASSERT_VOP_LOCKED(dp, "lookup"); 883 /* 884 * If we have a shared lock we may need to upgrade the lock for the 885 * last operation. 886 */ 887 if ((cnp->cn_flags & LOCKPARENT) && (cnp->cn_flags & ISLASTCN) && 888 dp != vp_crossmp && VOP_ISLOCKED(dp) == LK_SHARED) 889 vn_lock(dp, LK_UPGRADE|LK_RETRY); 890 if ((dp->v_iflag & VI_DOOMED) != 0) { 891 error = ENOENT; 892 goto bad; 893 } 894 /* 895 * If we're looking up the last component and we need an exclusive 896 * lock, adjust our lkflags. 897 */ 898 if (needs_exclusive_leaf(dp->v_mount, cnp->cn_flags)) 899 cnp->cn_lkflags = LK_EXCLUSIVE; 900 #ifdef NAMEI_DIAGNOSTIC 901 vn_printf(dp, "lookup in "); 902 #endif 903 lkflags_save = cnp->cn_lkflags; 904 cnp->cn_lkflags = compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags, 905 cnp->cn_flags); 906 error = VOP_LOOKUP(dp, &ndp->ni_vp, cnp); 907 cnp->cn_lkflags = lkflags_save; 908 if (error != 0) { 909 KASSERT(ndp->ni_vp == NULL, ("leaf should be empty")); 910 #ifdef NAMEI_DIAGNOSTIC 911 printf("not found\n"); 912 #endif 913 if ((error == ENOENT) && 914 (dp->v_vflag & VV_ROOT) && (dp->v_mount != NULL) && 915 (dp->v_mount->mnt_flag & MNT_UNION)) { 916 tdp = dp; 917 dp = dp->v_mount->mnt_vnodecovered; 918 VREF(dp); 919 vput(tdp); 920 vn_lock(dp, 921 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | 922 LK_RETRY, cnp->cn_flags)); 923 nameicap_tracker_add(ndp, dp); 924 goto unionlookup; 925 } 926 927 if (error == ERELOOKUP) { 928 vref(dp); 929 ndp->ni_vp = dp; 930 error = 0; 931 relookup = 1; 932 goto good; 933 } 934 935 if (error != EJUSTRETURN) 936 goto bad; 937 /* 938 * At this point, we know we're at the end of the 939 * pathname. If creating / renaming, we can consider 940 * allowing the file or directory to be created / renamed, 941 * provided we're not on a read-only filesystem. 942 */ 943 if (rdonly) { 944 error = EROFS; 945 goto bad; 946 } 947 /* trailing slash only allowed for directories */ 948 if ((cnp->cn_flags & TRAILINGSLASH) && 949 !(cnp->cn_flags & WILLBEDIR)) { 950 error = ENOENT; 951 goto bad; 952 } 953 if ((cnp->cn_flags & LOCKPARENT) == 0) 954 VOP_UNLOCK(dp, 0); 955 /* 956 * We return with ni_vp NULL to indicate that the entry 957 * doesn't currently exist, leaving a pointer to the 958 * (possibly locked) directory vnode in ndp->ni_dvp. 959 */ 960 if (cnp->cn_flags & SAVESTART) { 961 ndp->ni_startdir = ndp->ni_dvp; 962 VREF(ndp->ni_startdir); 963 } 964 goto success; 965 } 966 967 good: 968 #ifdef NAMEI_DIAGNOSTIC 969 printf("found\n"); 970 #endif 971 dp = ndp->ni_vp; 972 973 /* 974 * Check to see if the vnode has been mounted on; 975 * if so find the root of the mounted filesystem. 976 */ 977 while (dp->v_type == VDIR && (mp = dp->v_mountedhere) && 978 (cnp->cn_flags & NOCROSSMOUNT) == 0) { 979 if (vfs_busy(mp, 0)) 980 continue; 981 vput(dp); 982 if (dp != ndp->ni_dvp) 983 vput(ndp->ni_dvp); 984 else 985 vrele(ndp->ni_dvp); 986 vrefact(vp_crossmp); 987 ndp->ni_dvp = vp_crossmp; 988 error = VFS_ROOT(mp, compute_cn_lkflags(mp, cnp->cn_lkflags, 989 cnp->cn_flags), &tdp); 990 vfs_unbusy(mp); 991 if (vn_lock(vp_crossmp, LK_SHARED | LK_NOWAIT)) 992 panic("vp_crossmp exclusively locked or reclaimed"); 993 if (error) { 994 dpunlocked = 1; 995 goto bad2; 996 } 997 ndp->ni_vp = dp = tdp; 998 } 999 1000 /* 1001 * Check for symbolic link 1002 */ 1003 if ((dp->v_type == VLNK) && 1004 ((cnp->cn_flags & FOLLOW) || (cnp->cn_flags & TRAILINGSLASH) || 1005 *ndp->ni_next == '/')) { 1006 cnp->cn_flags |= ISSYMLINK; 1007 if (dp->v_iflag & VI_DOOMED) { 1008 /* 1009 * We can't know whether the directory was mounted with 1010 * NOSYMFOLLOW, so we can't follow safely. 1011 */ 1012 error = ENOENT; 1013 goto bad2; 1014 } 1015 if (dp->v_mount->mnt_flag & MNT_NOSYMFOLLOW) { 1016 error = EACCES; 1017 goto bad2; 1018 } 1019 /* 1020 * Symlink code always expects an unlocked dvp. 1021 */ 1022 if (ndp->ni_dvp != ndp->ni_vp) { 1023 VOP_UNLOCK(ndp->ni_dvp, 0); 1024 ni_dvp_unlocked = 1; 1025 } 1026 goto success; 1027 } 1028 1029 nextname: 1030 /* 1031 * Not a symbolic link that we will follow. Continue with the 1032 * next component if there is any; otherwise, we're done. 1033 */ 1034 KASSERT((cnp->cn_flags & ISLASTCN) || *ndp->ni_next == '/', 1035 ("lookup: invalid path state.")); 1036 if (relookup) { 1037 relookup = 0; 1038 ndp->ni_pathlen = prev_ni_pathlen; 1039 ndp->ni_next = prev_ni_next; 1040 if (ndp->ni_dvp != dp) 1041 vput(ndp->ni_dvp); 1042 else 1043 vrele(ndp->ni_dvp); 1044 goto dirloop; 1045 } 1046 if (cnp->cn_flags & ISDOTDOT) { 1047 error = nameicap_check_dotdot(ndp, ndp->ni_vp); 1048 if (error != 0) { 1049 #ifdef KTRACE 1050 if (KTRPOINT(curthread, KTR_CAPFAIL)) 1051 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 1052 #endif 1053 goto bad2; 1054 } 1055 } 1056 if (*ndp->ni_next == '/') { 1057 cnp->cn_nameptr = ndp->ni_next; 1058 while (*cnp->cn_nameptr == '/') { 1059 cnp->cn_nameptr++; 1060 ndp->ni_pathlen--; 1061 } 1062 if (ndp->ni_dvp != dp) 1063 vput(ndp->ni_dvp); 1064 else 1065 vrele(ndp->ni_dvp); 1066 goto dirloop; 1067 } 1068 /* 1069 * If we're processing a path with a trailing slash, 1070 * check that the end result is a directory. 1071 */ 1072 if ((cnp->cn_flags & TRAILINGSLASH) && dp->v_type != VDIR) { 1073 error = ENOTDIR; 1074 goto bad2; 1075 } 1076 /* 1077 * Disallow directory write attempts on read-only filesystems. 1078 */ 1079 if (rdonly && 1080 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 1081 error = EROFS; 1082 goto bad2; 1083 } 1084 if (cnp->cn_flags & SAVESTART) { 1085 ndp->ni_startdir = ndp->ni_dvp; 1086 VREF(ndp->ni_startdir); 1087 } 1088 if (!wantparent) { 1089 ni_dvp_unlocked = 2; 1090 if (ndp->ni_dvp != dp) 1091 vput(ndp->ni_dvp); 1092 else 1093 vrele(ndp->ni_dvp); 1094 } else if ((cnp->cn_flags & LOCKPARENT) == 0 && ndp->ni_dvp != dp) { 1095 VOP_UNLOCK(ndp->ni_dvp, 0); 1096 ni_dvp_unlocked = 1; 1097 } 1098 1099 if (cnp->cn_flags & AUDITVNODE1) 1100 AUDIT_ARG_VNODE1(dp); 1101 else if (cnp->cn_flags & AUDITVNODE2) 1102 AUDIT_ARG_VNODE2(dp); 1103 1104 if ((cnp->cn_flags & LOCKLEAF) == 0) 1105 VOP_UNLOCK(dp, 0); 1106 success: 1107 /* 1108 * Because of lookup_shared we may have the vnode shared locked, but 1109 * the caller may want it to be exclusively locked. 1110 */ 1111 if (needs_exclusive_leaf(dp->v_mount, cnp->cn_flags) && 1112 VOP_ISLOCKED(dp) != LK_EXCLUSIVE) { 1113 vn_lock(dp, LK_UPGRADE | LK_RETRY); 1114 if (dp->v_iflag & VI_DOOMED) { 1115 error = ENOENT; 1116 goto bad2; 1117 } 1118 } 1119 return (0); 1120 1121 bad2: 1122 if (ni_dvp_unlocked != 2) { 1123 if (dp != ndp->ni_dvp && !ni_dvp_unlocked) 1124 vput(ndp->ni_dvp); 1125 else 1126 vrele(ndp->ni_dvp); 1127 } 1128 bad: 1129 if (!dpunlocked) 1130 vput(dp); 1131 ndp->ni_vp = NULL; 1132 return (error); 1133 } 1134 1135 /* 1136 * relookup - lookup a path name component 1137 * Used by lookup to re-acquire things. 1138 */ 1139 int 1140 relookup(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp) 1141 { 1142 struct vnode *dp = NULL; /* the directory we are searching */ 1143 int wantparent; /* 1 => wantparent or lockparent flag */ 1144 int rdonly; /* lookup read-only flag bit */ 1145 int error = 0; 1146 1147 KASSERT(cnp->cn_flags & ISLASTCN, 1148 ("relookup: Not given last component.")); 1149 /* 1150 * Setup: break out flag bits into variables. 1151 */ 1152 wantparent = cnp->cn_flags & (LOCKPARENT|WANTPARENT); 1153 KASSERT(wantparent, ("relookup: parent not wanted.")); 1154 rdonly = cnp->cn_flags & RDONLY; 1155 cnp->cn_flags &= ~ISSYMLINK; 1156 dp = dvp; 1157 cnp->cn_lkflags = LK_EXCLUSIVE; 1158 vn_lock(dp, LK_EXCLUSIVE | LK_RETRY); 1159 1160 /* 1161 * Search a new directory. 1162 * 1163 * The last component of the filename is left accessible via 1164 * cnp->cn_nameptr for callers that need the name. Callers needing 1165 * the name set the SAVENAME flag. When done, they assume 1166 * responsibility for freeing the pathname buffer. 1167 */ 1168 #ifdef NAMEI_DIAGNOSTIC 1169 printf("{%s}: ", cnp->cn_nameptr); 1170 #endif 1171 1172 /* 1173 * Check for "" which represents the root directory after slash 1174 * removal. 1175 */ 1176 if (cnp->cn_nameptr[0] == '\0') { 1177 /* 1178 * Support only LOOKUP for "/" because lookup() 1179 * can't succeed for CREATE, DELETE and RENAME. 1180 */ 1181 KASSERT(cnp->cn_nameiop == LOOKUP, ("nameiop must be LOOKUP")); 1182 KASSERT(dp->v_type == VDIR, ("dp is not a directory")); 1183 1184 if (!(cnp->cn_flags & LOCKLEAF)) 1185 VOP_UNLOCK(dp, 0); 1186 *vpp = dp; 1187 /* XXX This should probably move to the top of function. */ 1188 if (cnp->cn_flags & SAVESTART) 1189 panic("lookup: SAVESTART"); 1190 return (0); 1191 } 1192 1193 if (cnp->cn_flags & ISDOTDOT) 1194 panic ("relookup: lookup on dot-dot"); 1195 1196 /* 1197 * We now have a segment name to search for, and a directory to search. 1198 */ 1199 #ifdef NAMEI_DIAGNOSTIC 1200 vn_printf(dp, "search in "); 1201 #endif 1202 if ((error = VOP_LOOKUP(dp, vpp, cnp)) != 0) { 1203 KASSERT(*vpp == NULL, ("leaf should be empty")); 1204 if (error != EJUSTRETURN) 1205 goto bad; 1206 /* 1207 * If creating and at end of pathname, then can consider 1208 * allowing file to be created. 1209 */ 1210 if (rdonly) { 1211 error = EROFS; 1212 goto bad; 1213 } 1214 /* ASSERT(dvp == ndp->ni_startdir) */ 1215 if (cnp->cn_flags & SAVESTART) 1216 VREF(dvp); 1217 if ((cnp->cn_flags & LOCKPARENT) == 0) 1218 VOP_UNLOCK(dp, 0); 1219 /* 1220 * We return with ni_vp NULL to indicate that the entry 1221 * doesn't currently exist, leaving a pointer to the 1222 * (possibly locked) directory vnode in ndp->ni_dvp. 1223 */ 1224 return (0); 1225 } 1226 1227 dp = *vpp; 1228 1229 /* 1230 * Disallow directory write attempts on read-only filesystems. 1231 */ 1232 if (rdonly && 1233 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 1234 if (dvp == dp) 1235 vrele(dvp); 1236 else 1237 vput(dvp); 1238 error = EROFS; 1239 goto bad; 1240 } 1241 /* 1242 * Set the parent lock/ref state to the requested state. 1243 */ 1244 if ((cnp->cn_flags & LOCKPARENT) == 0 && dvp != dp) { 1245 if (wantparent) 1246 VOP_UNLOCK(dvp, 0); 1247 else 1248 vput(dvp); 1249 } else if (!wantparent) 1250 vrele(dvp); 1251 /* 1252 * Check for symbolic link 1253 */ 1254 KASSERT(dp->v_type != VLNK || !(cnp->cn_flags & FOLLOW), 1255 ("relookup: symlink found.\n")); 1256 1257 /* ASSERT(dvp == ndp->ni_startdir) */ 1258 if (cnp->cn_flags & SAVESTART) 1259 VREF(dvp); 1260 1261 if ((cnp->cn_flags & LOCKLEAF) == 0) 1262 VOP_UNLOCK(dp, 0); 1263 return (0); 1264 bad: 1265 vput(dp); 1266 *vpp = NULL; 1267 return (error); 1268 } 1269 1270 void 1271 NDINIT_ALL(struct nameidata *ndp, u_long op, u_long flags, enum uio_seg segflg, 1272 const char *namep, int dirfd, struct vnode *startdir, cap_rights_t *rightsp, 1273 struct thread *td) 1274 { 1275 1276 ndp->ni_cnd.cn_nameiop = op; 1277 ndp->ni_cnd.cn_flags = flags; 1278 ndp->ni_segflg = segflg; 1279 ndp->ni_dirp = namep; 1280 ndp->ni_dirfd = dirfd; 1281 ndp->ni_startdir = startdir; 1282 if (rightsp != NULL) 1283 ndp->ni_rightsneeded = *rightsp; 1284 else 1285 cap_rights_init(&ndp->ni_rightsneeded); 1286 filecaps_init(&ndp->ni_filecaps); 1287 ndp->ni_cnd.cn_thread = td; 1288 } 1289 1290 /* 1291 * Free data allocated by namei(); see namei(9) for details. 1292 */ 1293 void 1294 NDFREE(struct nameidata *ndp, const u_int flags) 1295 { 1296 int unlock_dvp; 1297 int unlock_vp; 1298 1299 unlock_dvp = 0; 1300 unlock_vp = 0; 1301 1302 if (!(flags & NDF_NO_FREE_PNBUF) && 1303 (ndp->ni_cnd.cn_flags & HASBUF)) { 1304 uma_zfree(namei_zone, ndp->ni_cnd.cn_pnbuf); 1305 ndp->ni_cnd.cn_flags &= ~HASBUF; 1306 } 1307 if (!(flags & NDF_NO_VP_UNLOCK) && 1308 (ndp->ni_cnd.cn_flags & LOCKLEAF) && ndp->ni_vp) 1309 unlock_vp = 1; 1310 if (!(flags & NDF_NO_VP_RELE) && ndp->ni_vp) { 1311 if (unlock_vp) { 1312 vput(ndp->ni_vp); 1313 unlock_vp = 0; 1314 } else 1315 vrele(ndp->ni_vp); 1316 ndp->ni_vp = NULL; 1317 } 1318 if (unlock_vp) 1319 VOP_UNLOCK(ndp->ni_vp, 0); 1320 if (!(flags & NDF_NO_DVP_UNLOCK) && 1321 (ndp->ni_cnd.cn_flags & LOCKPARENT) && 1322 ndp->ni_dvp != ndp->ni_vp) 1323 unlock_dvp = 1; 1324 if (!(flags & NDF_NO_DVP_RELE) && 1325 (ndp->ni_cnd.cn_flags & (LOCKPARENT|WANTPARENT))) { 1326 if (unlock_dvp) { 1327 vput(ndp->ni_dvp); 1328 unlock_dvp = 0; 1329 } else 1330 vrele(ndp->ni_dvp); 1331 ndp->ni_dvp = NULL; 1332 } 1333 if (unlock_dvp) 1334 VOP_UNLOCK(ndp->ni_dvp, 0); 1335 if (!(flags & NDF_NO_STARTDIR_RELE) && 1336 (ndp->ni_cnd.cn_flags & SAVESTART)) { 1337 vrele(ndp->ni_startdir); 1338 ndp->ni_startdir = NULL; 1339 } 1340 } 1341 1342 /* 1343 * Determine if there is a suitable alternate filename under the specified 1344 * prefix for the specified path. If the create flag is set, then the 1345 * alternate prefix will be used so long as the parent directory exists. 1346 * This is used by the various compatibility ABIs so that Linux binaries prefer 1347 * files under /compat/linux for example. The chosen path (whether under 1348 * the prefix or under /) is returned in a kernel malloc'd buffer pointed 1349 * to by pathbuf. The caller is responsible for free'ing the buffer from 1350 * the M_TEMP bucket if one is returned. 1351 */ 1352 int 1353 kern_alternate_path(struct thread *td, const char *prefix, const char *path, 1354 enum uio_seg pathseg, char **pathbuf, int create, int dirfd) 1355 { 1356 struct nameidata nd, ndroot; 1357 char *ptr, *buf, *cp; 1358 size_t len, sz; 1359 int error; 1360 1361 buf = (char *) malloc(MAXPATHLEN, M_TEMP, M_WAITOK); 1362 *pathbuf = buf; 1363 1364 /* Copy the prefix into the new pathname as a starting point. */ 1365 len = strlcpy(buf, prefix, MAXPATHLEN); 1366 if (len >= MAXPATHLEN) { 1367 *pathbuf = NULL; 1368 free(buf, M_TEMP); 1369 return (EINVAL); 1370 } 1371 sz = MAXPATHLEN - len; 1372 ptr = buf + len; 1373 1374 /* Append the filename to the prefix. */ 1375 if (pathseg == UIO_SYSSPACE) 1376 error = copystr(path, ptr, sz, &len); 1377 else 1378 error = copyinstr(path, ptr, sz, &len); 1379 1380 if (error) { 1381 *pathbuf = NULL; 1382 free(buf, M_TEMP); 1383 return (error); 1384 } 1385 1386 /* Only use a prefix with absolute pathnames. */ 1387 if (*ptr != '/') { 1388 error = EINVAL; 1389 goto keeporig; 1390 } 1391 1392 if (dirfd != AT_FDCWD) { 1393 /* 1394 * We want the original because the "prefix" is 1395 * included in the already opened dirfd. 1396 */ 1397 bcopy(ptr, buf, len); 1398 return (0); 1399 } 1400 1401 /* 1402 * We know that there is a / somewhere in this pathname. 1403 * Search backwards for it, to find the file's parent dir 1404 * to see if it exists in the alternate tree. If it does, 1405 * and we want to create a file (cflag is set). We don't 1406 * need to worry about the root comparison in this case. 1407 */ 1408 1409 if (create) { 1410 for (cp = &ptr[len] - 1; *cp != '/'; cp--); 1411 *cp = '\0'; 1412 1413 NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_SYSSPACE, buf, td); 1414 error = namei(&nd); 1415 *cp = '/'; 1416 if (error != 0) 1417 goto keeporig; 1418 } else { 1419 NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_SYSSPACE, buf, td); 1420 1421 error = namei(&nd); 1422 if (error != 0) 1423 goto keeporig; 1424 1425 /* 1426 * We now compare the vnode of the prefix to the one 1427 * vnode asked. If they resolve to be the same, then we 1428 * ignore the match so that the real root gets used. 1429 * This avoids the problem of traversing "../.." to find the 1430 * root directory and never finding it, because "/" resolves 1431 * to the emulation root directory. This is expensive :-( 1432 */ 1433 NDINIT(&ndroot, LOOKUP, FOLLOW, UIO_SYSSPACE, prefix, 1434 td); 1435 1436 /* We shouldn't ever get an error from this namei(). */ 1437 error = namei(&ndroot); 1438 if (error == 0) { 1439 if (nd.ni_vp == ndroot.ni_vp) 1440 error = ENOENT; 1441 1442 NDFREE(&ndroot, NDF_ONLY_PNBUF); 1443 vrele(ndroot.ni_vp); 1444 } 1445 } 1446 1447 NDFREE(&nd, NDF_ONLY_PNBUF); 1448 vrele(nd.ni_vp); 1449 1450 keeporig: 1451 /* If there was an error, use the original path name. */ 1452 if (error) 1453 bcopy(ptr, buf, len); 1454 return (error); 1455 }
Cache object: 4cf2454a84bc359204805a1891df7242
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]