1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23 */
24
25 #include <sys/zfs_context.h>
26 #include <sys/dmu.h>
27 #include <sys/avl.h>
28 #include <sys/zap.h>
29 #include <sys/refcount.h>
30 #include <sys/nvpair.h>
31 #ifdef _KERNEL
32 #include <sys/kidmap.h>
33 #include <sys/sid.h>
34 #include <sys/zfs_vfsops.h>
35 #include <sys/zfs_znode.h>
36 #endif
37 #include <sys/zfs_fuid.h>
38
39 /*
40 * FUID Domain table(s).
41 *
42 * The FUID table is stored as a packed nvlist of an array
43 * of nvlists which contain an index, domain string and offset
44 *
45 * During file system initialization the nvlist(s) are read and
46 * two AVL trees are created. One tree is keyed by the index number
47 * and the other by the domain string. Nodes are never removed from
48 * trees, but new entries may be added. If a new entry is added then
49 * the zfsvfs->z_fuid_dirty flag is set to true and the caller will then
50 * be responsible for calling zfs_fuid_sync() to sync the changes to disk.
51 *
52 */
53
54 #define FUID_IDX "fuid_idx"
55 #define FUID_DOMAIN "fuid_domain"
56 #define FUID_OFFSET "fuid_offset"
57 #define FUID_NVP_ARRAY "fuid_nvlist"
58
59 typedef struct fuid_domain {
60 avl_node_t f_domnode;
61 avl_node_t f_idxnode;
62 ksiddomain_t *f_ksid;
63 uint64_t f_idx;
64 } fuid_domain_t;
65
66 static char *nulldomain = "";
67
68 /*
69 * Compare two indexes.
70 */
71 static int
idx_compare(const void * arg1,const void * arg2)72 idx_compare(const void *arg1, const void *arg2)
73 {
74 const fuid_domain_t *node1 = arg1;
75 const fuid_domain_t *node2 = arg2;
76
77 if (node1->f_idx < node2->f_idx)
78 return (-1);
79 else if (node1->f_idx > node2->f_idx)
80 return (1);
81 return (0);
82 }
83
84 /*
85 * Compare two domain strings.
86 */
87 static int
domain_compare(const void * arg1,const void * arg2)88 domain_compare(const void *arg1, const void *arg2)
89 {
90 const fuid_domain_t *node1 = arg1;
91 const fuid_domain_t *node2 = arg2;
92 int val;
93
94 val = strcmp(node1->f_ksid->kd_name, node2->f_ksid->kd_name);
95 if (val == 0)
96 return (0);
97 return (val > 0 ? 1 : -1);
98 }
99
100 void
zfs_fuid_avl_tree_create(avl_tree_t * idx_tree,avl_tree_t * domain_tree)101 zfs_fuid_avl_tree_create(avl_tree_t *idx_tree, avl_tree_t *domain_tree)
102 {
103 avl_create(idx_tree, idx_compare,
104 sizeof (fuid_domain_t), offsetof(fuid_domain_t, f_idxnode));
105 avl_create(domain_tree, domain_compare,
106 sizeof (fuid_domain_t), offsetof(fuid_domain_t, f_domnode));
107 }
108
109 /*
110 * load initial fuid domain and idx trees. This function is used by
111 * both the kernel and zdb.
112 */
113 uint64_t
zfs_fuid_table_load(objset_t * os,uint64_t fuid_obj,avl_tree_t * idx_tree,avl_tree_t * domain_tree)114 zfs_fuid_table_load(objset_t *os, uint64_t fuid_obj, avl_tree_t *idx_tree,
115 avl_tree_t *domain_tree)
116 {
117 dmu_buf_t *db;
118 uint64_t fuid_size;
119
120 ASSERT(fuid_obj != 0);
121 VERIFY(0 == dmu_bonus_hold(os, fuid_obj,
122 FTAG, &db));
123 fuid_size = *(uint64_t *)db->db_data;
124 dmu_buf_rele(db, FTAG);
125
126 if (fuid_size) {
127 nvlist_t **fuidnvp;
128 nvlist_t *nvp = NULL;
129 uint_t count;
130 char *packed;
131 int i;
132
133 packed = kmem_alloc(fuid_size, KM_SLEEP);
134 VERIFY(dmu_read(os, fuid_obj, 0,
135 fuid_size, packed, DMU_READ_PREFETCH) == 0);
136 VERIFY(nvlist_unpack(packed, fuid_size,
137 &nvp, 0) == 0);
138 VERIFY(nvlist_lookup_nvlist_array(nvp, FUID_NVP_ARRAY,
139 &fuidnvp, &count) == 0);
140
141 for (i = 0; i != count; i++) {
142 fuid_domain_t *domnode;
143 char *domain;
144 uint64_t idx;
145
146 VERIFY(nvlist_lookup_string(fuidnvp[i], FUID_DOMAIN,
147 &domain) == 0);
148 VERIFY(nvlist_lookup_uint64(fuidnvp[i], FUID_IDX,
149 &idx) == 0);
150
151 domnode = kmem_alloc(sizeof (fuid_domain_t), KM_SLEEP);
152
153 domnode->f_idx = idx;
154 domnode->f_ksid = ksid_lookupdomain(domain);
155 avl_add(idx_tree, domnode);
156 avl_add(domain_tree, domnode);
157 }
158 nvlist_free(nvp);
159 kmem_free(packed, fuid_size);
160 }
161 return (fuid_size);
162 }
163
164 void
zfs_fuid_table_destroy(avl_tree_t * idx_tree,avl_tree_t * domain_tree)165 zfs_fuid_table_destroy(avl_tree_t *idx_tree, avl_tree_t *domain_tree)
166 {
167 fuid_domain_t *domnode;
168 void *cookie;
169
170 cookie = NULL;
171 while (domnode = avl_destroy_nodes(domain_tree, &cookie))
172 ksiddomain_rele(domnode->f_ksid);
173
174 avl_destroy(domain_tree);
175 cookie = NULL;
176 while (domnode = avl_destroy_nodes(idx_tree, &cookie))
177 kmem_free(domnode, sizeof (fuid_domain_t));
178 avl_destroy(idx_tree);
179 }
180
181 char *
zfs_fuid_idx_domain(avl_tree_t * idx_tree,uint32_t idx)182 zfs_fuid_idx_domain(avl_tree_t *idx_tree, uint32_t idx)
183 {
184 fuid_domain_t searchnode, *findnode;
185 avl_index_t loc;
186
187 searchnode.f_idx = idx;
188
189 findnode = avl_find(idx_tree, &searchnode, &loc);
190
191 return (findnode ? findnode->f_ksid->kd_name : nulldomain);
192 }
193
194 #ifdef _KERNEL
195 /*
196 * Load the fuid table(s) into memory.
197 */
198 static void
zfs_fuid_init(zfsvfs_t * zfsvfs)199 zfs_fuid_init(zfsvfs_t *zfsvfs)
200 {
201 rw_enter(&zfsvfs->z_fuid_lock, RW_WRITER);
202
203 if (zfsvfs->z_fuid_loaded) {
204 rw_exit(&zfsvfs->z_fuid_lock);
205 return;
206 }
207
208 zfs_fuid_avl_tree_create(&zfsvfs->z_fuid_idx, &zfsvfs->z_fuid_domain);
209
210 (void) zap_lookup(zfsvfs->z_os, MASTER_NODE_OBJ,
211 ZFS_FUID_TABLES, 8, 1, &zfsvfs->z_fuid_obj);
212 if (zfsvfs->z_fuid_obj != 0) {
213 zfsvfs->z_fuid_size = zfs_fuid_table_load(zfsvfs->z_os,
214 zfsvfs->z_fuid_obj, &zfsvfs->z_fuid_idx,
215 &zfsvfs->z_fuid_domain);
216 }
217
218 zfsvfs->z_fuid_loaded = B_TRUE;
219 rw_exit(&zfsvfs->z_fuid_lock);
220 }
221
222 /*
223 * sync out AVL trees to persistent storage.
224 */
225 void
zfs_fuid_sync(zfsvfs_t * zfsvfs,dmu_tx_t * tx)226 zfs_fuid_sync(zfsvfs_t *zfsvfs, dmu_tx_t *tx)
227 {
228 nvlist_t *nvp;
229 nvlist_t **fuids;
230 size_t nvsize = 0;
231 char *packed;
232 dmu_buf_t *db;
233 fuid_domain_t *domnode;
234 int numnodes;
235 int i;
236
237 if (!zfsvfs->z_fuid_dirty) {
238 return;
239 }
240
241 rw_enter(&zfsvfs->z_fuid_lock, RW_WRITER);
242
243 /*
244 * First see if table needs to be created?
245 */
246 if (zfsvfs->z_fuid_obj == 0) {
247 zfsvfs->z_fuid_obj = dmu_object_alloc(zfsvfs->z_os,
248 DMU_OT_FUID, 1 << 14, DMU_OT_FUID_SIZE,
249 sizeof (uint64_t), tx);
250 VERIFY(zap_add(zfsvfs->z_os, MASTER_NODE_OBJ,
251 ZFS_FUID_TABLES, sizeof (uint64_t), 1,
252 &zfsvfs->z_fuid_obj, tx) == 0);
253 }
254
255 VERIFY(nvlist_alloc(&nvp, NV_UNIQUE_NAME, KM_SLEEP) == 0);
256
257 numnodes = avl_numnodes(&zfsvfs->z_fuid_idx);
258 fuids = kmem_alloc(numnodes * sizeof (void *), KM_SLEEP);
259 for (i = 0, domnode = avl_first(&zfsvfs->z_fuid_domain); domnode; i++,
260 domnode = AVL_NEXT(&zfsvfs->z_fuid_domain, domnode)) {
261 VERIFY(nvlist_alloc(&fuids[i], NV_UNIQUE_NAME, KM_SLEEP) == 0);
262 VERIFY(nvlist_add_uint64(fuids[i], FUID_IDX,
263 domnode->f_idx) == 0);
264 VERIFY(nvlist_add_uint64(fuids[i], FUID_OFFSET, 0) == 0);
265 VERIFY(nvlist_add_string(fuids[i], FUID_DOMAIN,
266 domnode->f_ksid->kd_name) == 0);
267 }
268 VERIFY(nvlist_add_nvlist_array(nvp, FUID_NVP_ARRAY,
269 fuids, numnodes) == 0);
270 for (i = 0; i != numnodes; i++)
271 nvlist_free(fuids[i]);
272 kmem_free(fuids, numnodes * sizeof (void *));
273 VERIFY(nvlist_size(nvp, &nvsize, NV_ENCODE_XDR) == 0);
274 packed = kmem_alloc(nvsize, KM_SLEEP);
275 VERIFY(nvlist_pack(nvp, &packed, &nvsize,
276 NV_ENCODE_XDR, KM_SLEEP) == 0);
277 nvlist_free(nvp);
278 zfsvfs->z_fuid_size = nvsize;
279 dmu_write(zfsvfs->z_os, zfsvfs->z_fuid_obj, 0,
280 zfsvfs->z_fuid_size, packed, tx);
281 kmem_free(packed, zfsvfs->z_fuid_size);
282 VERIFY(0 == dmu_bonus_hold(zfsvfs->z_os, zfsvfs->z_fuid_obj,
283 FTAG, &db));
284 dmu_buf_will_dirty(db, tx);
285 *(uint64_t *)db->db_data = zfsvfs->z_fuid_size;
286 dmu_buf_rele(db, FTAG);
287
288 zfsvfs->z_fuid_dirty = B_FALSE;
289 rw_exit(&zfsvfs->z_fuid_lock);
290 }
291
292 /*
293 * Query domain table for a given domain.
294 *
295 * If domain isn't found and addok is set, it is added to AVL trees and
296 * the zfsvfs->z_fuid_dirty flag will be set to TRUE. It will then be
297 * necessary for the caller or another thread to detect the dirty table
298 * and sync out the changes.
299 */
300 int
zfs_fuid_find_by_domain(zfsvfs_t * zfsvfs,const char * domain,char ** retdomain,boolean_t addok)301 zfs_fuid_find_by_domain(zfsvfs_t *zfsvfs, const char *domain,
302 char **retdomain, boolean_t addok)
303 {
304 fuid_domain_t searchnode, *findnode;
305 avl_index_t loc;
306 krw_t rw = RW_READER;
307
308 /*
309 * If the dummy "nobody" domain then return an index of 0
310 * to cause the created FUID to be a standard POSIX id
311 * for the user nobody.
312 */
313 if (domain[0] == '\0') {
314 if (retdomain)
315 *retdomain = nulldomain;
316 return (0);
317 }
318
319 searchnode.f_ksid = ksid_lookupdomain(domain);
320 if (retdomain)
321 *retdomain = searchnode.f_ksid->kd_name;
322 if (!zfsvfs->z_fuid_loaded)
323 zfs_fuid_init(zfsvfs);
324
325 retry:
326 rw_enter(&zfsvfs->z_fuid_lock, rw);
327 findnode = avl_find(&zfsvfs->z_fuid_domain, &searchnode, &loc);
328
329 if (findnode) {
330 rw_exit(&zfsvfs->z_fuid_lock);
331 ksiddomain_rele(searchnode.f_ksid);
332 return (findnode->f_idx);
333 } else if (addok) {
334 fuid_domain_t *domnode;
335 uint64_t retidx;
336
337 if (rw == RW_READER && !rw_tryupgrade(&zfsvfs->z_fuid_lock)) {
338 rw_exit(&zfsvfs->z_fuid_lock);
339 rw = RW_WRITER;
340 goto retry;
341 }
342
343 domnode = kmem_alloc(sizeof (fuid_domain_t), KM_SLEEP);
344 domnode->f_ksid = searchnode.f_ksid;
345
346 retidx = domnode->f_idx = avl_numnodes(&zfsvfs->z_fuid_idx) + 1;
347
348 avl_add(&zfsvfs->z_fuid_domain, domnode);
349 avl_add(&zfsvfs->z_fuid_idx, domnode);
350 zfsvfs->z_fuid_dirty = B_TRUE;
351 rw_exit(&zfsvfs->z_fuid_lock);
352 return (retidx);
353 } else {
354 rw_exit(&zfsvfs->z_fuid_lock);
355 return (-1);
356 }
357 }
358
359 /*
360 * Query domain table by index, returning domain string
361 *
362 * Returns a pointer from an avl node of the domain string.
363 *
364 */
365 const char *
zfs_fuid_find_by_idx(zfsvfs_t * zfsvfs,uint32_t idx)366 zfs_fuid_find_by_idx(zfsvfs_t *zfsvfs, uint32_t idx)
367 {
368 char *domain;
369
370 if (idx == 0 || !zfsvfs->z_use_fuids)
371 return (NULL);
372
373 if (!zfsvfs->z_fuid_loaded)
374 zfs_fuid_init(zfsvfs);
375
376 rw_enter(&zfsvfs->z_fuid_lock, RW_READER);
377
378 if (zfsvfs->z_fuid_obj || zfsvfs->z_fuid_dirty)
379 domain = zfs_fuid_idx_domain(&zfsvfs->z_fuid_idx, idx);
380 else
381 domain = nulldomain;
382 rw_exit(&zfsvfs->z_fuid_lock);
383
384 ASSERT(domain);
385 return (domain);
386 }
387
388 void
zfs_fuid_map_ids(znode_t * zp,cred_t * cr,uid_t * uidp,uid_t * gidp)389 zfs_fuid_map_ids(znode_t *zp, cred_t *cr, uid_t *uidp, uid_t *gidp)
390 {
391 *uidp = zfs_fuid_map_id(zp->z_zfsvfs, zp->z_uid, cr, ZFS_OWNER);
392 *gidp = zfs_fuid_map_id(zp->z_zfsvfs, zp->z_gid, cr, ZFS_GROUP);
393 }
394
395 uid_t
zfs_fuid_map_id(zfsvfs_t * zfsvfs,uint64_t fuid,cred_t * cr,zfs_fuid_type_t type)396 zfs_fuid_map_id(zfsvfs_t *zfsvfs, uint64_t fuid,
397 cred_t *cr, zfs_fuid_type_t type)
398 {
399 uint32_t index = FUID_INDEX(fuid);
400 const char *domain;
401 uid_t id;
402
403 if (index == 0)
404 return (fuid);
405
406 domain = zfs_fuid_find_by_idx(zfsvfs, index);
407 ASSERT(domain != NULL);
408
409 #ifdef illumos
410 if (type == ZFS_OWNER || type == ZFS_ACE_USER) {
411 (void) kidmap_getuidbysid(crgetzone(cr), domain,
412 FUID_RID(fuid), &id);
413 } else {
414 (void) kidmap_getgidbysid(crgetzone(cr), domain,
415 FUID_RID(fuid), &id);
416 }
417 #else
418 id = UID_NOBODY;
419 #endif
420 return (id);
421 }
422
423 /*
424 * Add a FUID node to the list of fuid's being created for this
425 * ACL
426 *
427 * If ACL has multiple domains, then keep only one copy of each unique
428 * domain.
429 */
430 void
zfs_fuid_node_add(zfs_fuid_info_t ** fuidpp,const char * domain,uint32_t rid,uint64_t idx,uint64_t id,zfs_fuid_type_t type)431 zfs_fuid_node_add(zfs_fuid_info_t **fuidpp, const char *domain, uint32_t rid,
432 uint64_t idx, uint64_t id, zfs_fuid_type_t type)
433 {
434 zfs_fuid_t *fuid;
435 zfs_fuid_domain_t *fuid_domain;
436 zfs_fuid_info_t *fuidp;
437 uint64_t fuididx;
438 boolean_t found = B_FALSE;
439
440 if (*fuidpp == NULL)
441 *fuidpp = zfs_fuid_info_alloc();
442
443 fuidp = *fuidpp;
444 /*
445 * First find fuid domain index in linked list
446 *
447 * If one isn't found then create an entry.
448 */
449
450 for (fuididx = 1, fuid_domain = list_head(&fuidp->z_domains);
451 fuid_domain; fuid_domain = list_next(&fuidp->z_domains,
452 fuid_domain), fuididx++) {
453 if (idx == fuid_domain->z_domidx) {
454 found = B_TRUE;
455 break;
456 }
457 }
458
459 if (!found) {
460 fuid_domain = kmem_alloc(sizeof (zfs_fuid_domain_t), KM_SLEEP);
461 fuid_domain->z_domain = domain;
462 fuid_domain->z_domidx = idx;
463 list_insert_tail(&fuidp->z_domains, fuid_domain);
464 fuidp->z_domain_str_sz += strlen(domain) + 1;
465 fuidp->z_domain_cnt++;
466 }
467
468 if (type == ZFS_ACE_USER || type == ZFS_ACE_GROUP) {
469
470 /*
471 * Now allocate fuid entry and add it on the end of the list
472 */
473
474 fuid = kmem_alloc(sizeof (zfs_fuid_t), KM_SLEEP);
475 fuid->z_id = id;
476 fuid->z_domidx = idx;
477 fuid->z_logfuid = FUID_ENCODE(fuididx, rid);
478
479 list_insert_tail(&fuidp->z_fuids, fuid);
480 fuidp->z_fuid_cnt++;
481 } else {
482 if (type == ZFS_OWNER)
483 fuidp->z_fuid_owner = FUID_ENCODE(fuididx, rid);
484 else
485 fuidp->z_fuid_group = FUID_ENCODE(fuididx, rid);
486 }
487 }
488
489 /*
490 * Create a file system FUID, based on information in the users cred
491 *
492 * If cred contains KSID_OWNER then it should be used to determine
493 * the uid otherwise cred's uid will be used. By default cred's gid
494 * is used unless it's an ephemeral ID in which case KSID_GROUP will
495 * be used if it exists.
496 */
497 uint64_t
zfs_fuid_create_cred(zfsvfs_t * zfsvfs,zfs_fuid_type_t type,cred_t * cr,zfs_fuid_info_t ** fuidp)498 zfs_fuid_create_cred(zfsvfs_t *zfsvfs, zfs_fuid_type_t type,
499 cred_t *cr, zfs_fuid_info_t **fuidp)
500 {
501 uint64_t idx;
502 ksid_t *ksid;
503 uint32_t rid;
504 char *kdomain;
505 const char *domain;
506 uid_t id;
507
508 VERIFY(type == ZFS_OWNER || type == ZFS_GROUP);
509
510 ksid = crgetsid(cr, (type == ZFS_OWNER) ? KSID_OWNER : KSID_GROUP);
511
512 if (!zfsvfs->z_use_fuids || (ksid == NULL)) {
513 id = (type == ZFS_OWNER) ? crgetuid(cr) : crgetgid(cr);
514
515 if (IS_EPHEMERAL(id))
516 return ((type == ZFS_OWNER) ? UID_NOBODY : GID_NOBODY);
517
518 return ((uint64_t)id);
519 }
520
521 /*
522 * ksid is present and FUID is supported
523 */
524 id = (type == ZFS_OWNER) ? ksid_getid(ksid) : crgetgid(cr);
525
526 if (!IS_EPHEMERAL(id))
527 return ((uint64_t)id);
528
529 if (type == ZFS_GROUP)
530 id = ksid_getid(ksid);
531
532 rid = ksid_getrid(ksid);
533 domain = ksid_getdomain(ksid);
534
535 idx = zfs_fuid_find_by_domain(zfsvfs, domain, &kdomain, B_TRUE);
536
537 zfs_fuid_node_add(fuidp, kdomain, rid, idx, id, type);
538
539 return (FUID_ENCODE(idx, rid));
540 }
541
542 /*
543 * Create a file system FUID for an ACL ace
544 * or a chown/chgrp of the file.
545 * This is similar to zfs_fuid_create_cred, except that
546 * we can't find the domain + rid information in the
547 * cred. Instead we have to query Winchester for the
548 * domain and rid.
549 *
550 * During replay operations the domain+rid information is
551 * found in the zfs_fuid_info_t that the replay code has
552 * attached to the zfsvfs of the file system.
553 */
554 uint64_t
zfs_fuid_create(zfsvfs_t * zfsvfs,uint64_t id,cred_t * cr,zfs_fuid_type_t type,zfs_fuid_info_t ** fuidpp)555 zfs_fuid_create(zfsvfs_t *zfsvfs, uint64_t id, cred_t *cr,
556 zfs_fuid_type_t type, zfs_fuid_info_t **fuidpp)
557 {
558 const char *domain;
559 char *kdomain;
560 uint32_t fuid_idx = FUID_INDEX(id);
561 uint32_t rid = UID_NOBODY; // XXX: broken clang
562 idmap_stat status;
563 uint64_t idx = 0;
564 zfs_fuid_t *zfuid = NULL;
565 zfs_fuid_info_t *fuidp = NULL;
566
567 /*
568 * If POSIX ID, or entry is already a FUID then
569 * just return the id
570 *
571 * We may also be handed an already FUID'ized id via
572 * chmod.
573 */
574
575 if (!zfsvfs->z_use_fuids || !IS_EPHEMERAL(id) || fuid_idx != 0)
576 return (id);
577
578 if (zfsvfs->z_replay) {
579 fuidp = zfsvfs->z_fuid_replay;
580
581 /*
582 * If we are passed an ephemeral id, but no
583 * fuid_info was logged then return NOBODY.
584 * This is most likely a result of idmap service
585 * not being available.
586 */
587 if (fuidp == NULL)
588 return (UID_NOBODY);
589
590 VERIFY3U(type, >=, ZFS_OWNER);
591 VERIFY3U(type, <=, ZFS_ACE_GROUP);
592
593 switch (type) {
594 case ZFS_ACE_USER:
595 case ZFS_ACE_GROUP:
596 zfuid = list_head(&fuidp->z_fuids);
597 rid = FUID_RID(zfuid->z_logfuid);
598 idx = FUID_INDEX(zfuid->z_logfuid);
599 break;
600 case ZFS_OWNER:
601 rid = FUID_RID(fuidp->z_fuid_owner);
602 idx = FUID_INDEX(fuidp->z_fuid_owner);
603 break;
604 case ZFS_GROUP:
605 rid = FUID_RID(fuidp->z_fuid_group);
606 idx = FUID_INDEX(fuidp->z_fuid_group);
607 break;
608 default:
609 rid = UID_NOBODY;
610 break;
611 };
612 if (idx == 0)
613 domain = nulldomain;
614 else
615 domain = fuidp->z_domain_table[idx - 1];
616 } else {
617 if (type == ZFS_OWNER || type == ZFS_ACE_USER)
618 status = kidmap_getsidbyuid(crgetzone(cr), id,
619 &domain, &rid);
620 else
621 status = kidmap_getsidbygid(crgetzone(cr), id,
622 &domain, &rid);
623
624 if (status != 0) {
625 /*
626 * When returning nobody we will need to
627 * make a dummy fuid table entry for logging
628 * purposes.
629 */
630 rid = UID_NOBODY;
631 domain = nulldomain;
632 }
633 }
634
635 idx = zfs_fuid_find_by_domain(zfsvfs, domain, &kdomain, B_TRUE);
636
637 if (!zfsvfs->z_replay)
638 zfs_fuid_node_add(fuidpp, kdomain,
639 rid, idx, id, type);
640 else if (zfuid != NULL) {
641 list_remove(&fuidp->z_fuids, zfuid);
642 kmem_free(zfuid, sizeof (zfs_fuid_t));
643 }
644 return (FUID_ENCODE(idx, rid));
645 }
646
647 void
zfs_fuid_destroy(zfsvfs_t * zfsvfs)648 zfs_fuid_destroy(zfsvfs_t *zfsvfs)
649 {
650 rw_enter(&zfsvfs->z_fuid_lock, RW_WRITER);
651 if (!zfsvfs->z_fuid_loaded) {
652 rw_exit(&zfsvfs->z_fuid_lock);
653 return;
654 }
655 zfs_fuid_table_destroy(&zfsvfs->z_fuid_idx, &zfsvfs->z_fuid_domain);
656 rw_exit(&zfsvfs->z_fuid_lock);
657 }
658
659 /*
660 * Allocate zfs_fuid_info for tracking FUIDs created during
661 * zfs_mknode, VOP_SETATTR() or VOP_SETSECATTR()
662 */
663 zfs_fuid_info_t *
zfs_fuid_info_alloc(void)664 zfs_fuid_info_alloc(void)
665 {
666 zfs_fuid_info_t *fuidp;
667
668 fuidp = kmem_zalloc(sizeof (zfs_fuid_info_t), KM_SLEEP);
669 list_create(&fuidp->z_domains, sizeof (zfs_fuid_domain_t),
670 offsetof(zfs_fuid_domain_t, z_next));
671 list_create(&fuidp->z_fuids, sizeof (zfs_fuid_t),
672 offsetof(zfs_fuid_t, z_next));
673 return (fuidp);
674 }
675
676 /*
677 * Release all memory associated with zfs_fuid_info_t
678 */
679 void
zfs_fuid_info_free(zfs_fuid_info_t * fuidp)680 zfs_fuid_info_free(zfs_fuid_info_t *fuidp)
681 {
682 zfs_fuid_t *zfuid;
683 zfs_fuid_domain_t *zdomain;
684
685 while ((zfuid = list_head(&fuidp->z_fuids)) != NULL) {
686 list_remove(&fuidp->z_fuids, zfuid);
687 kmem_free(zfuid, sizeof (zfs_fuid_t));
688 }
689
690 if (fuidp->z_domain_table != NULL)
691 kmem_free(fuidp->z_domain_table,
692 (sizeof (char **)) * fuidp->z_domain_cnt);
693
694 while ((zdomain = list_head(&fuidp->z_domains)) != NULL) {
695 list_remove(&fuidp->z_domains, zdomain);
696 kmem_free(zdomain, sizeof (zfs_fuid_domain_t));
697 }
698
699 kmem_free(fuidp, sizeof (zfs_fuid_info_t));
700 }
701
702 /*
703 * Check to see if id is a groupmember. If cred
704 * has ksid info then sidlist is checked first
705 * and if still not found then POSIX groups are checked
706 *
707 * Will use a straight FUID compare when possible.
708 */
709 boolean_t
zfs_groupmember(zfsvfs_t * zfsvfs,uint64_t id,cred_t * cr)710 zfs_groupmember(zfsvfs_t *zfsvfs, uint64_t id, cred_t *cr)
711 {
712 #ifdef illumos
713 ksid_t *ksid = crgetsid(cr, KSID_GROUP);
714 ksidlist_t *ksidlist = crgetsidlist(cr);
715 #endif
716 uid_t gid;
717
718 #ifdef illumos
719 if (ksid && ksidlist) {
720 int i;
721 ksid_t *ksid_groups;
722 uint32_t idx = FUID_INDEX(id);
723 uint32_t rid = FUID_RID(id);
724
725 ksid_groups = ksidlist->ksl_sids;
726
727 for (i = 0; i != ksidlist->ksl_nsid; i++) {
728 if (idx == 0) {
729 if (id != IDMAP_WK_CREATOR_GROUP_GID &&
730 id == ksid_groups[i].ks_id) {
731 return (B_TRUE);
732 }
733 } else {
734 const char *domain;
735
736 domain = zfs_fuid_find_by_idx(zfsvfs, idx);
737 ASSERT(domain != NULL);
738
739 if (strcmp(domain,
740 IDMAP_WK_CREATOR_SID_AUTHORITY) == 0)
741 return (B_FALSE);
742
743 if ((strcmp(domain,
744 ksid_groups[i].ks_domain->kd_name) == 0) &&
745 rid == ksid_groups[i].ks_rid)
746 return (B_TRUE);
747 }
748 }
749 }
750 #endif /* illumos */
751
752 /*
753 * Not found in ksidlist, check posix groups
754 */
755 gid = zfs_fuid_map_id(zfsvfs, id, cr, ZFS_GROUP);
756 return (groupmember(gid, cr));
757 }
758
759 void
zfs_fuid_txhold(zfsvfs_t * zfsvfs,dmu_tx_t * tx)760 zfs_fuid_txhold(zfsvfs_t *zfsvfs, dmu_tx_t *tx)
761 {
762 if (zfsvfs->z_fuid_obj == 0) {
763 dmu_tx_hold_bonus(tx, DMU_NEW_OBJECT);
764 dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0,
765 FUID_SIZE_ESTIMATE(zfsvfs));
766 dmu_tx_hold_zap(tx, MASTER_NODE_OBJ, FALSE, NULL);
767 } else {
768 dmu_tx_hold_bonus(tx, zfsvfs->z_fuid_obj);
769 dmu_tx_hold_write(tx, zfsvfs->z_fuid_obj, 0,
770 FUID_SIZE_ESTIMATE(zfsvfs));
771 }
772 }
773 #endif
774