1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23 */
24
25 #include <sys/zfs_context.h>
26 #include <sys/dmu.h>
27 #include <sys/avl.h>
28 #include <sys/zap.h>
29 #include <sys/nvpair.h>
30 #ifdef _KERNEL
31 #include <sys/sid.h>
32 #include <sys/zfs_vfsops.h>
33 #include <sys/zfs_znode.h>
34 #endif
35 #include <sys/zfs_fuid.h>
36
37 /*
38 * FUID Domain table(s).
39 *
40 * The FUID table is stored as a packed nvlist of an array
41 * of nvlists which contain an index, domain string and offset
42 *
43 * During file system initialization the nvlist(s) are read and
44 * two AVL trees are created. One tree is keyed by the index number
45 * and the other by the domain string. Nodes are never removed from
46 * trees, but new entries may be added. If a new entry is added then
47 * the zfsvfs->z_fuid_dirty flag is set to true and the caller will then
48 * be responsible for calling zfs_fuid_sync() to sync the changes to disk.
49 *
50 */
51
52 #define FUID_IDX "fuid_idx"
53 #define FUID_DOMAIN "fuid_domain"
54 #define FUID_OFFSET "fuid_offset"
55 #define FUID_NVP_ARRAY "fuid_nvlist"
56
57 typedef struct fuid_domain {
58 avl_node_t f_domnode;
59 avl_node_t f_idxnode;
60 ksiddomain_t *f_ksid;
61 uint64_t f_idx;
62 } fuid_domain_t;
63
64 static char *nulldomain = "";
65
66 /*
67 * Compare two indexes.
68 */
69 static int
idx_compare(const void * arg1,const void * arg2)70 idx_compare(const void *arg1, const void *arg2)
71 {
72 const fuid_domain_t *node1 = (const fuid_domain_t *)arg1;
73 const fuid_domain_t *node2 = (const fuid_domain_t *)arg2;
74
75 return (TREE_CMP(node1->f_idx, node2->f_idx));
76 }
77
78 /*
79 * Compare two domain strings.
80 */
81 static int
domain_compare(const void * arg1,const void * arg2)82 domain_compare(const void *arg1, const void *arg2)
83 {
84 const fuid_domain_t *node1 = (const fuid_domain_t *)arg1;
85 const fuid_domain_t *node2 = (const fuid_domain_t *)arg2;
86 int val;
87
88 val = strcmp(node1->f_ksid->kd_name, node2->f_ksid->kd_name);
89
90 return (TREE_ISIGN(val));
91 }
92
93 void
zfs_fuid_avl_tree_create(avl_tree_t * idx_tree,avl_tree_t * domain_tree)94 zfs_fuid_avl_tree_create(avl_tree_t *idx_tree, avl_tree_t *domain_tree)
95 {
96 avl_create(idx_tree, idx_compare,
97 sizeof (fuid_domain_t), offsetof(fuid_domain_t, f_idxnode));
98 avl_create(domain_tree, domain_compare,
99 sizeof (fuid_domain_t), offsetof(fuid_domain_t, f_domnode));
100 }
101
102 /*
103 * load initial fuid domain and idx trees. This function is used by
104 * both the kernel and zdb.
105 */
106 uint64_t
zfs_fuid_table_load(objset_t * os,uint64_t fuid_obj,avl_tree_t * idx_tree,avl_tree_t * domain_tree)107 zfs_fuid_table_load(objset_t *os, uint64_t fuid_obj, avl_tree_t *idx_tree,
108 avl_tree_t *domain_tree)
109 {
110 dmu_buf_t *db;
111 uint64_t fuid_size;
112
113 ASSERT(fuid_obj != 0);
114 VERIFY(0 == dmu_bonus_hold(os, fuid_obj,
115 FTAG, &db));
116 fuid_size = *(uint64_t *)db->db_data;
117 dmu_buf_rele(db, FTAG);
118
119 if (fuid_size) {
120 nvlist_t **fuidnvp;
121 nvlist_t *nvp = NULL;
122 uint_t count;
123 char *packed;
124 int i;
125
126 packed = kmem_alloc(fuid_size, KM_SLEEP);
127 VERIFY(dmu_read(os, fuid_obj, 0,
128 fuid_size, packed, DMU_READ_PREFETCH) == 0);
129 VERIFY(nvlist_unpack(packed, fuid_size,
130 &nvp, 0) == 0);
131 VERIFY(nvlist_lookup_nvlist_array(nvp, FUID_NVP_ARRAY,
132 &fuidnvp, &count) == 0);
133
134 for (i = 0; i != count; i++) {
135 fuid_domain_t *domnode;
136 char *domain;
137 uint64_t idx;
138
139 VERIFY(nvlist_lookup_string(fuidnvp[i], FUID_DOMAIN,
140 &domain) == 0);
141 VERIFY(nvlist_lookup_uint64(fuidnvp[i], FUID_IDX,
142 &idx) == 0);
143
144 domnode = kmem_alloc(sizeof (fuid_domain_t), KM_SLEEP);
145
146 domnode->f_idx = idx;
147 domnode->f_ksid = ksid_lookupdomain(domain);
148 avl_add(idx_tree, domnode);
149 avl_add(domain_tree, domnode);
150 }
151 nvlist_free(nvp);
152 kmem_free(packed, fuid_size);
153 }
154 return (fuid_size);
155 }
156
157 void
zfs_fuid_table_destroy(avl_tree_t * idx_tree,avl_tree_t * domain_tree)158 zfs_fuid_table_destroy(avl_tree_t *idx_tree, avl_tree_t *domain_tree)
159 {
160 fuid_domain_t *domnode;
161 void *cookie;
162
163 cookie = NULL;
164 while ((domnode = avl_destroy_nodes(domain_tree, &cookie)))
165 ksiddomain_rele(domnode->f_ksid);
166
167 avl_destroy(domain_tree);
168 cookie = NULL;
169 while ((domnode = avl_destroy_nodes(idx_tree, &cookie)))
170 kmem_free(domnode, sizeof (fuid_domain_t));
171 avl_destroy(idx_tree);
172 }
173
174 char *
zfs_fuid_idx_domain(avl_tree_t * idx_tree,uint32_t idx)175 zfs_fuid_idx_domain(avl_tree_t *idx_tree, uint32_t idx)
176 {
177 fuid_domain_t searchnode, *findnode;
178 avl_index_t loc;
179
180 searchnode.f_idx = idx;
181
182 findnode = avl_find(idx_tree, &searchnode, &loc);
183
184 return (findnode ? findnode->f_ksid->kd_name : nulldomain);
185 }
186
187 #ifdef _KERNEL
188 /*
189 * Load the fuid table(s) into memory.
190 */
191 static void
zfs_fuid_init(zfsvfs_t * zfsvfs)192 zfs_fuid_init(zfsvfs_t *zfsvfs)
193 {
194 rw_enter(&zfsvfs->z_fuid_lock, RW_WRITER);
195
196 if (zfsvfs->z_fuid_loaded) {
197 rw_exit(&zfsvfs->z_fuid_lock);
198 return;
199 }
200
201 zfs_fuid_avl_tree_create(&zfsvfs->z_fuid_idx, &zfsvfs->z_fuid_domain);
202
203 (void) zap_lookup(zfsvfs->z_os, MASTER_NODE_OBJ,
204 ZFS_FUID_TABLES, 8, 1, &zfsvfs->z_fuid_obj);
205 if (zfsvfs->z_fuid_obj != 0) {
206 zfsvfs->z_fuid_size = zfs_fuid_table_load(zfsvfs->z_os,
207 zfsvfs->z_fuid_obj, &zfsvfs->z_fuid_idx,
208 &zfsvfs->z_fuid_domain);
209 }
210
211 zfsvfs->z_fuid_loaded = B_TRUE;
212 rw_exit(&zfsvfs->z_fuid_lock);
213 }
214
215 /*
216 * sync out AVL trees to persistent storage.
217 */
218 void
zfs_fuid_sync(zfsvfs_t * zfsvfs,dmu_tx_t * tx)219 zfs_fuid_sync(zfsvfs_t *zfsvfs, dmu_tx_t *tx)
220 {
221 nvlist_t *nvp;
222 nvlist_t **fuids;
223 size_t nvsize = 0;
224 char *packed;
225 dmu_buf_t *db;
226 fuid_domain_t *domnode;
227 int numnodes;
228 int i;
229
230 if (!zfsvfs->z_fuid_dirty) {
231 return;
232 }
233
234 rw_enter(&zfsvfs->z_fuid_lock, RW_WRITER);
235
236 /*
237 * First see if table needs to be created?
238 */
239 if (zfsvfs->z_fuid_obj == 0) {
240 zfsvfs->z_fuid_obj = dmu_object_alloc(zfsvfs->z_os,
241 DMU_OT_FUID, 1 << 14, DMU_OT_FUID_SIZE,
242 sizeof (uint64_t), tx);
243 VERIFY(zap_add(zfsvfs->z_os, MASTER_NODE_OBJ,
244 ZFS_FUID_TABLES, sizeof (uint64_t), 1,
245 &zfsvfs->z_fuid_obj, tx) == 0);
246 }
247
248 VERIFY(nvlist_alloc(&nvp, NV_UNIQUE_NAME, KM_SLEEP) == 0);
249
250 numnodes = avl_numnodes(&zfsvfs->z_fuid_idx);
251 fuids = kmem_alloc(numnodes * sizeof (void *), KM_SLEEP);
252 for (i = 0, domnode = avl_first(&zfsvfs->z_fuid_domain); domnode; i++,
253 domnode = AVL_NEXT(&zfsvfs->z_fuid_domain, domnode)) {
254 VERIFY(nvlist_alloc(&fuids[i], NV_UNIQUE_NAME, KM_SLEEP) == 0);
255 VERIFY(nvlist_add_uint64(fuids[i], FUID_IDX,
256 domnode->f_idx) == 0);
257 VERIFY(nvlist_add_uint64(fuids[i], FUID_OFFSET, 0) == 0);
258 VERIFY(nvlist_add_string(fuids[i], FUID_DOMAIN,
259 domnode->f_ksid->kd_name) == 0);
260 }
261 VERIFY(nvlist_add_nvlist_array(nvp, FUID_NVP_ARRAY,
262 fuids, numnodes) == 0);
263 for (i = 0; i != numnodes; i++)
264 nvlist_free(fuids[i]);
265 kmem_free(fuids, numnodes * sizeof (void *));
266 VERIFY(nvlist_size(nvp, &nvsize, NV_ENCODE_XDR) == 0);
267 packed = kmem_alloc(nvsize, KM_SLEEP);
268 VERIFY(nvlist_pack(nvp, &packed, &nvsize,
269 NV_ENCODE_XDR, KM_SLEEP) == 0);
270 nvlist_free(nvp);
271 zfsvfs->z_fuid_size = nvsize;
272 dmu_write(zfsvfs->z_os, zfsvfs->z_fuid_obj, 0,
273 zfsvfs->z_fuid_size, packed, tx);
274 kmem_free(packed, zfsvfs->z_fuid_size);
275 VERIFY(0 == dmu_bonus_hold(zfsvfs->z_os, zfsvfs->z_fuid_obj,
276 FTAG, &db));
277 dmu_buf_will_dirty(db, tx);
278 *(uint64_t *)db->db_data = zfsvfs->z_fuid_size;
279 dmu_buf_rele(db, FTAG);
280
281 zfsvfs->z_fuid_dirty = B_FALSE;
282 rw_exit(&zfsvfs->z_fuid_lock);
283 }
284
285 /*
286 * Query domain table for a given domain.
287 *
288 * If domain isn't found and addok is set, it is added to AVL trees and
289 * the zfsvfs->z_fuid_dirty flag will be set to TRUE. It will then be
290 * necessary for the caller or another thread to detect the dirty table
291 * and sync out the changes.
292 */
293 int
zfs_fuid_find_by_domain(zfsvfs_t * zfsvfs,const char * domain,char ** retdomain,boolean_t addok)294 zfs_fuid_find_by_domain(zfsvfs_t *zfsvfs, const char *domain,
295 char **retdomain, boolean_t addok)
296 {
297 fuid_domain_t searchnode, *findnode;
298 avl_index_t loc;
299 krw_t rw = RW_READER;
300
301 /*
302 * If the dummy "nobody" domain then return an index of 0
303 * to cause the created FUID to be a standard POSIX id
304 * for the user nobody.
305 */
306 if (domain[0] == '\0') {
307 if (retdomain)
308 *retdomain = nulldomain;
309 return (0);
310 }
311
312 searchnode.f_ksid = ksid_lookupdomain(domain);
313 if (retdomain)
314 *retdomain = searchnode.f_ksid->kd_name;
315 if (!zfsvfs->z_fuid_loaded)
316 zfs_fuid_init(zfsvfs);
317
318 retry:
319 rw_enter(&zfsvfs->z_fuid_lock, rw);
320 findnode = avl_find(&zfsvfs->z_fuid_domain, &searchnode, &loc);
321
322 if (findnode) {
323 rw_exit(&zfsvfs->z_fuid_lock);
324 ksiddomain_rele(searchnode.f_ksid);
325 return (findnode->f_idx);
326 } else if (addok) {
327 fuid_domain_t *domnode;
328 uint64_t retidx;
329
330 if (rw == RW_READER && !rw_tryupgrade(&zfsvfs->z_fuid_lock)) {
331 rw_exit(&zfsvfs->z_fuid_lock);
332 rw = RW_WRITER;
333 goto retry;
334 }
335
336 domnode = kmem_alloc(sizeof (fuid_domain_t), KM_SLEEP);
337 domnode->f_ksid = searchnode.f_ksid;
338
339 retidx = domnode->f_idx = avl_numnodes(&zfsvfs->z_fuid_idx) + 1;
340
341 avl_add(&zfsvfs->z_fuid_domain, domnode);
342 avl_add(&zfsvfs->z_fuid_idx, domnode);
343 zfsvfs->z_fuid_dirty = B_TRUE;
344 rw_exit(&zfsvfs->z_fuid_lock);
345 return (retidx);
346 } else {
347 rw_exit(&zfsvfs->z_fuid_lock);
348 return (-1);
349 }
350 }
351
352 /*
353 * Query domain table by index, returning domain string
354 *
355 * Returns a pointer from an avl node of the domain string.
356 *
357 */
358 const char *
zfs_fuid_find_by_idx(zfsvfs_t * zfsvfs,uint32_t idx)359 zfs_fuid_find_by_idx(zfsvfs_t *zfsvfs, uint32_t idx)
360 {
361 char *domain;
362
363 if (idx == 0 || !zfsvfs->z_use_fuids)
364 return (NULL);
365
366 if (!zfsvfs->z_fuid_loaded)
367 zfs_fuid_init(zfsvfs);
368
369 rw_enter(&zfsvfs->z_fuid_lock, RW_READER);
370
371 if (zfsvfs->z_fuid_obj || zfsvfs->z_fuid_dirty)
372 domain = zfs_fuid_idx_domain(&zfsvfs->z_fuid_idx, idx);
373 else
374 domain = nulldomain;
375 rw_exit(&zfsvfs->z_fuid_lock);
376
377 ASSERT(domain);
378 return (domain);
379 }
380
381 void
zfs_fuid_map_ids(znode_t * zp,cred_t * cr,uid_t * uidp,uid_t * gidp)382 zfs_fuid_map_ids(znode_t *zp, cred_t *cr, uid_t *uidp, uid_t *gidp)
383 {
384 *uidp = zfs_fuid_map_id(ZTOZSB(zp), KUID_TO_SUID(ZTOUID(zp)),
385 cr, ZFS_OWNER);
386 *gidp = zfs_fuid_map_id(ZTOZSB(zp), KGID_TO_SGID(ZTOGID(zp)),
387 cr, ZFS_GROUP);
388 }
389
390 #ifdef __FreeBSD__
391 uid_t
zfs_fuid_map_id(zfsvfs_t * zfsvfs,uint64_t fuid,cred_t * cr,zfs_fuid_type_t type)392 zfs_fuid_map_id(zfsvfs_t *zfsvfs, uint64_t fuid,
393 cred_t *cr, zfs_fuid_type_t type)
394 {
395 uint32_t index = FUID_INDEX(fuid);
396
397 if (index == 0)
398 return (fuid);
399
400 return (UID_NOBODY);
401 }
402 #elif defined(__linux__)
403 uid_t
zfs_fuid_map_id(zfsvfs_t * zfsvfs,uint64_t fuid,cred_t * cr,zfs_fuid_type_t type)404 zfs_fuid_map_id(zfsvfs_t *zfsvfs, uint64_t fuid,
405 cred_t *cr, zfs_fuid_type_t type)
406 {
407 /*
408 * The Linux port only supports POSIX IDs, use the passed id.
409 */
410 return (fuid);
411 }
412
413 #else
414 uid_t
zfs_fuid_map_id(zfsvfs_t * zfsvfs,uint64_t fuid,cred_t * cr,zfs_fuid_type_t type)415 zfs_fuid_map_id(zfsvfs_t *zfsvfs, uint64_t fuid,
416 cred_t *cr, zfs_fuid_type_t type)
417 {
418 uint32_t index = FUID_INDEX(fuid);
419 const char *domain;
420 uid_t id;
421
422 if (index == 0)
423 return (fuid);
424
425 domain = zfs_fuid_find_by_idx(zfsvfs, index);
426 ASSERT(domain != NULL);
427
428 if (type == ZFS_OWNER || type == ZFS_ACE_USER) {
429 (void) kidmap_getuidbysid(crgetzone(cr), domain,
430 FUID_RID(fuid), &id);
431 } else {
432 (void) kidmap_getgidbysid(crgetzone(cr), domain,
433 FUID_RID(fuid), &id);
434 }
435 return (id);
436 }
437 #endif
438
439 /*
440 * Add a FUID node to the list of fuid's being created for this
441 * ACL
442 *
443 * If ACL has multiple domains, then keep only one copy of each unique
444 * domain.
445 */
446 void
zfs_fuid_node_add(zfs_fuid_info_t ** fuidpp,const char * domain,uint32_t rid,uint64_t idx,uint64_t id,zfs_fuid_type_t type)447 zfs_fuid_node_add(zfs_fuid_info_t **fuidpp, const char *domain, uint32_t rid,
448 uint64_t idx, uint64_t id, zfs_fuid_type_t type)
449 {
450 zfs_fuid_t *fuid;
451 zfs_fuid_domain_t *fuid_domain;
452 zfs_fuid_info_t *fuidp;
453 uint64_t fuididx;
454 boolean_t found = B_FALSE;
455
456 if (*fuidpp == NULL)
457 *fuidpp = zfs_fuid_info_alloc();
458
459 fuidp = *fuidpp;
460 /*
461 * First find fuid domain index in linked list
462 *
463 * If one isn't found then create an entry.
464 */
465
466 for (fuididx = 1, fuid_domain = list_head(&fuidp->z_domains);
467 fuid_domain; fuid_domain = list_next(&fuidp->z_domains,
468 fuid_domain), fuididx++) {
469 if (idx == fuid_domain->z_domidx) {
470 found = B_TRUE;
471 break;
472 }
473 }
474
475 if (!found) {
476 fuid_domain = kmem_alloc(sizeof (zfs_fuid_domain_t), KM_SLEEP);
477 fuid_domain->z_domain = domain;
478 fuid_domain->z_domidx = idx;
479 list_insert_tail(&fuidp->z_domains, fuid_domain);
480 fuidp->z_domain_str_sz += strlen(domain) + 1;
481 fuidp->z_domain_cnt++;
482 }
483
484 if (type == ZFS_ACE_USER || type == ZFS_ACE_GROUP) {
485
486 /*
487 * Now allocate fuid entry and add it on the end of the list
488 */
489
490 fuid = kmem_alloc(sizeof (zfs_fuid_t), KM_SLEEP);
491 fuid->z_id = id;
492 fuid->z_domidx = idx;
493 fuid->z_logfuid = FUID_ENCODE(fuididx, rid);
494
495 list_insert_tail(&fuidp->z_fuids, fuid);
496 fuidp->z_fuid_cnt++;
497 } else {
498 if (type == ZFS_OWNER)
499 fuidp->z_fuid_owner = FUID_ENCODE(fuididx, rid);
500 else
501 fuidp->z_fuid_group = FUID_ENCODE(fuididx, rid);
502 }
503 }
504
505 #ifdef HAVE_KSID
506 /*
507 * Create a file system FUID, based on information in the users cred
508 *
509 * If cred contains KSID_OWNER then it should be used to determine
510 * the uid otherwise cred's uid will be used. By default cred's gid
511 * is used unless it's an ephemeral ID in which case KSID_GROUP will
512 * be used if it exists.
513 */
514 uint64_t
zfs_fuid_create_cred(zfsvfs_t * zfsvfs,zfs_fuid_type_t type,cred_t * cr,zfs_fuid_info_t ** fuidp)515 zfs_fuid_create_cred(zfsvfs_t *zfsvfs, zfs_fuid_type_t type,
516 cred_t *cr, zfs_fuid_info_t **fuidp)
517 {
518 uint64_t idx;
519 ksid_t *ksid;
520 uint32_t rid;
521 char *kdomain;
522 const char *domain;
523 uid_t id;
524
525 VERIFY(type == ZFS_OWNER || type == ZFS_GROUP);
526
527 ksid = crgetsid(cr, (type == ZFS_OWNER) ? KSID_OWNER : KSID_GROUP);
528
529 if (!zfsvfs->z_use_fuids || (ksid == NULL)) {
530 id = (type == ZFS_OWNER) ? crgetuid(cr) : crgetgid(cr);
531
532 if (IS_EPHEMERAL(id))
533 return ((type == ZFS_OWNER) ? UID_NOBODY : GID_NOBODY);
534
535 return ((uint64_t)id);
536 }
537
538 /*
539 * ksid is present and FUID is supported
540 */
541 id = (type == ZFS_OWNER) ? ksid_getid(ksid) : crgetgid(cr);
542
543 if (!IS_EPHEMERAL(id))
544 return ((uint64_t)id);
545
546 if (type == ZFS_GROUP)
547 id = ksid_getid(ksid);
548
549 rid = ksid_getrid(ksid);
550 domain = ksid_getdomain(ksid);
551
552 idx = zfs_fuid_find_by_domain(zfsvfs, domain, &kdomain, B_TRUE);
553
554 zfs_fuid_node_add(fuidp, kdomain, rid, idx, id, type);
555
556 return (FUID_ENCODE(idx, rid));
557 }
558 #endif /* HAVE_KSID */
559
560 /*
561 * Create a file system FUID for an ACL ace
562 * or a chown/chgrp of the file.
563 * This is similar to zfs_fuid_create_cred, except that
564 * we can't find the domain + rid information in the
565 * cred. Instead we have to query Winchester for the
566 * domain and rid.
567 *
568 * During replay operations the domain+rid information is
569 * found in the zfs_fuid_info_t that the replay code has
570 * attached to the zfsvfs of the file system.
571 */
572 uint64_t
zfs_fuid_create(zfsvfs_t * zfsvfs,uint64_t id,cred_t * cr,zfs_fuid_type_t type,zfs_fuid_info_t ** fuidpp)573 zfs_fuid_create(zfsvfs_t *zfsvfs, uint64_t id, cred_t *cr,
574 zfs_fuid_type_t type, zfs_fuid_info_t **fuidpp)
575 {
576 #ifdef HAVE_KSID
577 const char *domain;
578 char *kdomain;
579 uint32_t fuid_idx = FUID_INDEX(id);
580 uint32_t rid = 0;
581 idmap_stat status;
582 uint64_t idx = UID_NOBODY;
583 zfs_fuid_t *zfuid = NULL;
584 zfs_fuid_info_t *fuidp = NULL;
585
586 /*
587 * If POSIX ID, or entry is already a FUID then
588 * just return the id
589 *
590 * We may also be handed an already FUID'ized id via
591 * chmod.
592 */
593
594 if (!zfsvfs->z_use_fuids || !IS_EPHEMERAL(id) || fuid_idx != 0)
595 return (id);
596
597 if (zfsvfs->z_replay) {
598 fuidp = zfsvfs->z_fuid_replay;
599
600 /*
601 * If we are passed an ephemeral id, but no
602 * fuid_info was logged then return NOBODY.
603 * This is most likely a result of idmap service
604 * not being available.
605 */
606 if (fuidp == NULL)
607 return (UID_NOBODY);
608
609 VERIFY3U(type, >=, ZFS_OWNER);
610 VERIFY3U(type, <=, ZFS_ACE_GROUP);
611
612 switch (type) {
613 case ZFS_ACE_USER:
614 case ZFS_ACE_GROUP:
615 zfuid = list_head(&fuidp->z_fuids);
616 rid = FUID_RID(zfuid->z_logfuid);
617 idx = FUID_INDEX(zfuid->z_logfuid);
618 break;
619 case ZFS_OWNER:
620 rid = FUID_RID(fuidp->z_fuid_owner);
621 idx = FUID_INDEX(fuidp->z_fuid_owner);
622 break;
623 case ZFS_GROUP:
624 rid = FUID_RID(fuidp->z_fuid_group);
625 idx = FUID_INDEX(fuidp->z_fuid_group);
626 break;
627 };
628 domain = fuidp->z_domain_table[idx - 1];
629 } else {
630 if (type == ZFS_OWNER || type == ZFS_ACE_USER)
631 status = kidmap_getsidbyuid(crgetzone(cr), id,
632 &domain, &rid);
633 else
634 status = kidmap_getsidbygid(crgetzone(cr), id,
635 &domain, &rid);
636
637 if (status != 0) {
638 /*
639 * When returning nobody we will need to
640 * make a dummy fuid table entry for logging
641 * purposes.
642 */
643 rid = UID_NOBODY;
644 domain = nulldomain;
645 }
646 }
647
648 idx = zfs_fuid_find_by_domain(zfsvfs, domain, &kdomain, B_TRUE);
649
650 if (!zfsvfs->z_replay)
651 zfs_fuid_node_add(fuidpp, kdomain,
652 rid, idx, id, type);
653 else if (zfuid != NULL) {
654 list_remove(&fuidp->z_fuids, zfuid);
655 kmem_free(zfuid, sizeof (zfs_fuid_t));
656 }
657 return (FUID_ENCODE(idx, rid));
658 #else
659 /*
660 * The Linux port only supports POSIX IDs, use the passed id.
661 */
662 return (id);
663 #endif
664 }
665
666 void
zfs_fuid_destroy(zfsvfs_t * zfsvfs)667 zfs_fuid_destroy(zfsvfs_t *zfsvfs)
668 {
669 rw_enter(&zfsvfs->z_fuid_lock, RW_WRITER);
670 if (!zfsvfs->z_fuid_loaded) {
671 rw_exit(&zfsvfs->z_fuid_lock);
672 return;
673 }
674 zfs_fuid_table_destroy(&zfsvfs->z_fuid_idx, &zfsvfs->z_fuid_domain);
675 rw_exit(&zfsvfs->z_fuid_lock);
676 }
677
678 /*
679 * Allocate zfs_fuid_info for tracking FUIDs created during
680 * zfs_mknode, VOP_SETATTR() or VOP_SETSECATTR()
681 */
682 zfs_fuid_info_t *
zfs_fuid_info_alloc(void)683 zfs_fuid_info_alloc(void)
684 {
685 zfs_fuid_info_t *fuidp;
686
687 fuidp = kmem_zalloc(sizeof (zfs_fuid_info_t), KM_SLEEP);
688 list_create(&fuidp->z_domains, sizeof (zfs_fuid_domain_t),
689 offsetof(zfs_fuid_domain_t, z_next));
690 list_create(&fuidp->z_fuids, sizeof (zfs_fuid_t),
691 offsetof(zfs_fuid_t, z_next));
692 return (fuidp);
693 }
694
695 /*
696 * Release all memory associated with zfs_fuid_info_t
697 */
698 void
zfs_fuid_info_free(zfs_fuid_info_t * fuidp)699 zfs_fuid_info_free(zfs_fuid_info_t *fuidp)
700 {
701 zfs_fuid_t *zfuid;
702 zfs_fuid_domain_t *zdomain;
703
704 while ((zfuid = list_head(&fuidp->z_fuids)) != NULL) {
705 list_remove(&fuidp->z_fuids, zfuid);
706 kmem_free(zfuid, sizeof (zfs_fuid_t));
707 }
708
709 if (fuidp->z_domain_table != NULL)
710 kmem_free(fuidp->z_domain_table,
711 (sizeof (char *)) * fuidp->z_domain_cnt);
712
713 while ((zdomain = list_head(&fuidp->z_domains)) != NULL) {
714 list_remove(&fuidp->z_domains, zdomain);
715 kmem_free(zdomain, sizeof (zfs_fuid_domain_t));
716 }
717
718 kmem_free(fuidp, sizeof (zfs_fuid_info_t));
719 }
720
721 /*
722 * Check to see if id is a groupmember. If cred
723 * has ksid info then sidlist is checked first
724 * and if still not found then POSIX groups are checked
725 *
726 * Will use a straight FUID compare when possible.
727 */
728 boolean_t
zfs_groupmember(zfsvfs_t * zfsvfs,uint64_t id,cred_t * cr)729 zfs_groupmember(zfsvfs_t *zfsvfs, uint64_t id, cred_t *cr)
730 {
731 #ifdef HAVE_KSID
732 uid_t gid;
733
734 #ifdef illumos
735 ksid_t *ksid = crgetsid(cr, KSID_GROUP);
736 ksidlist_t *ksidlist = crgetsidlist(cr);
737
738 if (ksid && ksidlist) {
739 int i;
740 ksid_t *ksid_groups;
741 uint32_t idx = FUID_INDEX(id);
742 uint32_t rid = FUID_RID(id);
743
744 ksid_groups = ksidlist->ksl_sids;
745
746 for (i = 0; i != ksidlist->ksl_nsid; i++) {
747 if (idx == 0) {
748 if (id != IDMAP_WK_CREATOR_GROUP_GID &&
749 id == ksid_groups[i].ks_id) {
750 return (B_TRUE);
751 }
752 } else {
753 const char *domain;
754
755 domain = zfs_fuid_find_by_idx(zfsvfs, idx);
756 ASSERT(domain != NULL);
757
758 if (strcmp(domain,
759 IDMAP_WK_CREATOR_SID_AUTHORITY) == 0)
760 return (B_FALSE);
761
762 if ((strcmp(domain,
763 ksid_groups[i].ks_domain->kd_name) == 0) &&
764 rid == ksid_groups[i].ks_rid)
765 return (B_TRUE);
766 }
767 }
768 }
769 #endif /* illumos */
770
771 /*
772 * Not found in ksidlist, check posix groups
773 */
774 gid = zfs_fuid_map_id(zfsvfs, id, cr, ZFS_GROUP);
775 return (groupmember(gid, cr));
776 #else
777 return (B_TRUE);
778 #endif
779 }
780
781 void
zfs_fuid_txhold(zfsvfs_t * zfsvfs,dmu_tx_t * tx)782 zfs_fuid_txhold(zfsvfs_t *zfsvfs, dmu_tx_t *tx)
783 {
784 if (zfsvfs->z_fuid_obj == 0) {
785 dmu_tx_hold_bonus(tx, DMU_NEW_OBJECT);
786 dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0,
787 FUID_SIZE_ESTIMATE(zfsvfs));
788 dmu_tx_hold_zap(tx, MASTER_NODE_OBJ, FALSE, NULL);
789 } else {
790 dmu_tx_hold_bonus(tx, zfsvfs->z_fuid_obj);
791 dmu_tx_hold_write(tx, zfsvfs->z_fuid_obj, 0,
792 FUID_SIZE_ESTIMATE(zfsvfs));
793 }
794 }
795
796 /*
797 * buf must be big enough (eg, 32 bytes)
798 */
799 int
zfs_id_to_fuidstr(zfsvfs_t * zfsvfs,const char * domain,uid_t rid,char * buf,size_t len,boolean_t addok)800 zfs_id_to_fuidstr(zfsvfs_t *zfsvfs, const char *domain, uid_t rid,
801 char *buf, size_t len, boolean_t addok)
802 {
803 uint64_t fuid;
804 int domainid = 0;
805
806 if (domain && domain[0]) {
807 domainid = zfs_fuid_find_by_domain(zfsvfs, domain, NULL, addok);
808 if (domainid == -1)
809 return (SET_ERROR(ENOENT));
810 }
811 fuid = FUID_ENCODE(domainid, rid);
812 (void) snprintf(buf, len, "%llx", (longlong_t)fuid);
813 return (0);
814 }
815 #endif
816