Fix a minor bug in the last commit. lwp_cpumask has to be in the LWP copy
[dragonfly.git] / sys / kern / kern_acl.c
CommitLineData
984263bc
MD
1/*-
2 * Copyright (c) 1999, 2000 Robert N. M. Watson
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 *
14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24 * SUCH DAMAGE.
25 *
26 * $FreeBSD: src/sys/kern/kern_acl.c,v 1.2.2.1 2000/07/28 18:48:16 rwatson Exp $
5b287bba 27 * $DragonFly: src/sys/kern/kern_acl.c,v 1.13 2006/05/24 03:23:31 dillon Exp $
984263bc
MD
28 */
29
30/*
31 * Generic routines to support file system ACLs, at a syntactic level
32 * Semantics are the responsibility of the underlying file system
33 */
34
35#include <sys/param.h>
36#include <sys/systm.h>
37#include <sys/sysproto.h>
38#include <sys/kernel.h>
39#include <sys/malloc.h>
40#include <sys/vnode.h>
41#include <sys/lock.h>
dadab5e9 42#include <sys/proc.h>
fad57d0e 43#include <sys/nlookup.h>
984263bc 44#include <sys/file.h>
984263bc
MD
45#include <sys/sysent.h>
46#include <sys/errno.h>
47#include <sys/stat.h>
48#include <sys/acl.h>
49
50static MALLOC_DEFINE(M_ACL, "acl", "access control list");
51
41c20dac
MD
52static int vacl_set_acl(struct vnode *vp, acl_type_t type, struct acl *aclp);
53static int vacl_get_acl(struct vnode *vp, acl_type_t type, struct acl *aclp);
54static int vacl_aclcheck(struct vnode *vp, acl_type_t type, struct acl *aclp);
984263bc
MD
55
56/*
57 * These calls wrap the real vnode operations, and are called by the
58 * syscall code once the syscall has converted the path or file
59 * descriptor to a vnode (unlocked). The aclp pointer is assumed
60 * still to point to userland, so this should not be consumed within
61 * the kernel except by syscall code. Other code should directly
62 * invoke VOP_{SET,GET}ACL.
63 */
64
65/*
66 * Given a vnode, set its ACL.
67 */
68static int
41c20dac 69vacl_set_acl(struct vnode *vp, acl_type_t type, struct acl *aclp)
984263bc 70{
dadab5e9 71 struct thread *td = curthread;
984263bc 72 struct acl inkernacl;
dadab5e9 73 struct ucred *ucred;
984263bc
MD
74 int error;
75
76 error = copyin(aclp, &inkernacl, sizeof(struct acl));
77 if (error)
78 return(error);
dadab5e9
MD
79 KKASSERT(td->td_proc);
80 ucred = td->td_proc->p_ucred;
81
ca466bae 82 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
87de5057 83 error = VOP_SETACL(vp, type, &inkernacl, ucred);
ca466bae 84 VOP_UNLOCK(vp, 0);
984263bc
MD
85 return(error);
86}
87
88/*
89 * Given a vnode, get its ACL.
90 */
91static int
41c20dac 92vacl_get_acl(struct vnode *vp, acl_type_t type, struct acl *aclp)
984263bc 93{
dadab5e9 94 struct thread *td = curthread;
984263bc 95 struct acl inkernelacl;
dadab5e9 96 struct ucred *ucred;
984263bc
MD
97 int error;
98
dadab5e9
MD
99 KKASSERT(td->td_proc);
100 ucred = td->td_proc->p_ucred;
87de5057 101 error = VOP_GETACL(vp, type, &inkernelacl, ucred);
984263bc
MD
102 if (error == 0)
103 error = copyout(&inkernelacl, aclp, sizeof(struct acl));
104 return (error);
105}
106
107/*
108 * Given a vnode, delete its ACL.
109 */
110static int
41c20dac 111vacl_delete(struct vnode *vp, acl_type_t type)
984263bc 112{
dadab5e9
MD
113 struct thread *td = curthread;
114 struct ucred *ucred;
984263bc
MD
115 int error;
116
dadab5e9
MD
117 KKASSERT(td->td_proc);
118 ucred = td->td_proc->p_ucred;
ca466bae 119 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
87de5057 120 error = VOP_SETACL(vp, ACL_TYPE_DEFAULT, 0, ucred);
ca466bae 121 VOP_UNLOCK(vp, 0);
984263bc
MD
122 return (error);
123}
124
125/*
126 * Given a vnode, check whether an ACL is appropriate for it
127 */
128static int
41c20dac 129vacl_aclcheck(struct vnode *vp, acl_type_t type, struct acl *aclp)
984263bc 130{
dadab5e9
MD
131 struct thread *td = curthread;
132 struct ucred *ucred;
984263bc
MD
133 struct acl inkernelacl;
134 int error;
135
dadab5e9
MD
136 KKASSERT(td->td_proc);
137 ucred = td->td_proc->p_ucred;
984263bc
MD
138 error = copyin(aclp, &inkernelacl, sizeof(struct acl));
139 if (error)
140 return(error);
87de5057 141 error = VOP_ACLCHECK(vp, type, &inkernelacl, ucred);
984263bc
MD
142 return (error);
143}
144
145/*
146 * syscalls -- convert the path/fd to a vnode, and call vacl_whatever.
147 * Don't need to lock, as the vacl_ code will get/release any locks
148 * required.
149 */
150
151/*
152 * Given a file path, get an ACL for it
153 */
154int
41c20dac 155__acl_get_file(struct __acl_get_file_args *uap)
984263bc 156{
fad57d0e
MD
157 struct nlookupdata nd;
158 struct vnode *vp;
984263bc
MD
159 int error;
160
fad57d0e 161 vp = NULL;
ab2eb4eb 162 error = nlookup_init(&nd, uap->path, UIO_USERSPACE, NLC_FOLLOW);
fad57d0e
MD
163 if (error == 0)
164 error = nlookup(&nd);
165 if (error == 0)
166 error = cache_vref(nd.nl_ncp, nd.nl_cred, &vp);
167 nlookup_done(&nd);
168 if (error == 0) {
ab2eb4eb 169 error = vacl_get_acl(vp, uap->type, uap->aclp);
fad57d0e
MD
170 vrele(vp);
171 }
984263bc
MD
172 return (error);
173}
174
175/*
176 * Given a file path, set an ACL for it
177 */
178int
41c20dac 179__acl_set_file(struct __acl_set_file_args *uap)
984263bc 180{
fad57d0e
MD
181 struct nlookupdata nd;
182 struct vnode *vp;
984263bc
MD
183 int error;
184
fad57d0e 185 vp = NULL;
ab2eb4eb 186 error = nlookup_init(&nd, uap->path, UIO_USERSPACE, NLC_FOLLOW);
fad57d0e
MD
187 if (error == 0)
188 error = nlookup(&nd);
189 if (error == 0)
190 error = cache_vref(nd.nl_ncp, nd.nl_cred, &vp);
191 nlookup_done(&nd);
192 if (error == 0) {
ab2eb4eb 193 error = vacl_set_acl(vp, uap->type, uap->aclp);
fad57d0e
MD
194 vrele(vp);
195 }
984263bc
MD
196 return (error);
197}
198
199/*
200 * Given a file descriptor, get an ACL for it
201 */
202int
41c20dac 203__acl_get_fd(struct __acl_get_fd_args *uap)
984263bc 204{
dadab5e9 205 struct thread *td = curthread;
984263bc
MD
206 struct file *fp;
207 int error;
208
dadab5e9 209 KKASSERT(td->td_proc);
5b287bba 210 if ((error = holdvnode(td->td_proc->p_fd, uap->filedes, &fp)) != 0)
984263bc 211 return(error);
5b287bba
MD
212 error = vacl_get_acl((struct vnode *)fp->f_data, uap->type, uap->aclp);
213 fdrop(fp);
214 return (error);
984263bc
MD
215}
216
217/*
218 * Given a file descriptor, set an ACL for it
219 */
220int
41c20dac 221__acl_set_fd(struct __acl_set_fd_args *uap)
984263bc 222{
dadab5e9 223 struct thread *td = curthread;
984263bc
MD
224 struct file *fp;
225 int error;
226
dadab5e9 227 KKASSERT(td->td_proc);
5b287bba 228 if ((error = holdvnode(td->td_proc->p_fd, uap->filedes, &fp)) != 0)
984263bc 229 return(error);
5b287bba
MD
230 error = vacl_set_acl((struct vnode *)fp->f_data, uap->type, uap->aclp);
231 fdrop(fp);
232 return (error);
984263bc
MD
233}
234
235/*
236 * Given a file path, delete an ACL from it.
237 */
238int
41c20dac 239__acl_delete_file(struct __acl_delete_file_args *uap)
984263bc 240{
fad57d0e
MD
241 struct nlookupdata nd;
242 struct vnode *vp;
984263bc
MD
243 int error;
244
fad57d0e 245 vp = NULL;
ab2eb4eb 246 error = nlookup_init(&nd, uap->path, UIO_USERSPACE, NLC_FOLLOW);
fad57d0e
MD
247 if (error == 0)
248 error = nlookup(&nd);
249 if (error == 0)
250 error = cache_vref(nd.nl_ncp, nd.nl_cred, &vp);
251 nlookup_done(&nd);
252
253 if (error == 0) {
ab2eb4eb 254 error = vacl_delete(vp, uap->type);
fad57d0e
MD
255 vrele(vp);
256 }
984263bc
MD
257 return (error);
258}
259
260/*
261 * Given a file path, delete an ACL from it.
262 */
263int
41c20dac 264__acl_delete_fd(struct __acl_delete_fd_args *uap)
984263bc 265{
dadab5e9 266 struct thread *td = curthread;
984263bc
MD
267 struct file *fp;
268 int error;
269
dadab5e9 270 KKASSERT(td->td_proc);
5b287bba 271 if ((error = holdvnode(td->td_proc->p_fd, uap->filedes, &fp)) != 0)
984263bc 272 return(error);
ab2eb4eb 273 error = vacl_delete((struct vnode *)fp->f_data, uap->type);
5b287bba 274 fdrop(fp);
984263bc
MD
275 return (error);
276}
277
278/*
279 * Given a file path, check an ACL for it
280 */
281int
41c20dac 282__acl_aclcheck_file(struct __acl_aclcheck_file_args *uap)
984263bc 283{
fad57d0e
MD
284 struct nlookupdata nd;
285 struct vnode *vp;
286 int error;
984263bc 287
fad57d0e 288 vp = NULL;
ab2eb4eb 289 error = nlookup_init(&nd, uap->path, UIO_USERSPACE, NLC_FOLLOW);
fad57d0e
MD
290 if (error == 0)
291 error = nlookup(&nd);
292 if (error == 0)
293 error = cache_vref(nd.nl_ncp, nd.nl_cred, &vp);
294 nlookup_done(&nd);
295
296 if (error == 0) {
ab2eb4eb 297 error = vacl_aclcheck(vp, uap->type, uap->aclp);
fad57d0e
MD
298 vrele(vp);
299 }
984263bc
MD
300 return (error);
301}
302
303/*
304 * Given a file descriptor, check an ACL for it
305 */
306int
41c20dac 307__acl_aclcheck_fd(struct __acl_aclcheck_fd_args *uap)
984263bc 308{
dadab5e9 309 struct thread *td = curthread;
984263bc
MD
310 struct file *fp;
311 int error;
312
dadab5e9 313 KKASSERT(td->td_proc);
5b287bba 314 if ((error = holdvnode(td->td_proc->p_fd, uap->filedes, &fp)) != 0)
984263bc 315 return(error);
5b287bba
MD
316 error = vacl_aclcheck((struct vnode *)fp->f_data, uap->type, uap->aclp);
317 fdrop(fp);
318 return (error);
984263bc 319}
5b287bba 320