2 * (The copyright below applies to ufs_access())
4 * Copyright (c) 1982, 1986, 1989, 1993, 1995
5 * The Regents of the University of California. All rights reserved.
6 * (c) UNIX System Laboratories, Inc.
7 * All or some portions of this file are derived from material licensed
8 * to the University of California by American Telephone and Telegraph
9 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
10 * the permission of UNIX System Laboratories, Inc.
12 * Redistribution and use in source and binary forms, with or without
13 * modification, are permitted provided that the following conditions
15 * 1. Redistributions of source code must retain the above copyright
16 * notice, this list of conditions and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 * notice, this list of conditions and the following disclaimer in the
19 * documentation and/or other materials provided with the distribution.
20 * 4. Neither the name of the University nor the names of its contributors
21 * may be used to endorse or promote products derived from this software
22 * without specific prior written permission.
24 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36 * @(#)ufs_vnops.c 8.27 (Berkeley) 5/27/95
37 * $DragonFly: src/sys/kern/vfs_helper.c,v 1.5 2008/05/25 18:34:46 dillon Exp $
40 #include "opt_quota.h"
41 #include "opt_suiddir.h"
43 #include <sys/param.h>
44 #include <sys/systm.h>
46 #include <sys/kernel.h>
47 #include <sys/fcntl.h>
49 #include <sys/mount.h>
50 #include <sys/unistd.h>
51 #include <sys/vnode.h>
52 #include <sys/file.h> /* XXX */
56 #include <sys/sysctl.h>
57 #include <sys/sfbuf.h>
58 #include <vm/vm_extern.h>
59 #include <vm/vm_object.h>
61 #ifdef LWBUF_IS_OPTIMAL
63 static int vm_read_shortcut_enable = 1;
64 static long vm_read_shortcut_count;
65 static long vm_read_shortcut_failed;
66 SYSCTL_INT(_vm, OID_AUTO, read_shortcut_enable, CTLFLAG_RW,
67 &vm_read_shortcut_enable, 0, "Direct vm_object vop_read shortcut");
68 SYSCTL_LONG(_vm, OID_AUTO, read_shortcut_count, CTLFLAG_RW,
69 &vm_read_shortcut_count, 0, "Statistics");
70 SYSCTL_LONG(_vm, OID_AUTO, read_shortcut_failed, CTLFLAG_RW,
71 &vm_read_shortcut_failed, 0, "Statistics");
78 * Provide standard UNIX semanics for VOP_ACCESS, but without the quota
79 * code. This procedure was basically pulled out of UFS.
82 vop_helper_access(struct vop_access_args *ap, uid_t ino_uid, gid_t ino_gid,
83 mode_t ino_mode, u_int32_t ino_flags)
85 struct vnode *vp = ap->a_vp;
86 struct ucred *cred = ap->a_cred;
87 mode_t mask, mode = ap->a_mode;
93 if (ap->a_flags & AT_EACCESS) {
94 proc_uid = cred->cr_uid;
95 proc_gid = cred->cr_gid;
97 proc_uid = cred->cr_ruid;
98 proc_gid = cred->cr_rgid;
102 * Disallow write attempts on read-only filesystems;
103 * unless the file is a socket, fifo, or a block or
104 * character device resident on the filesystem.
107 switch (vp->v_type) {
112 if (vp->v_mount->mnt_flag & MNT_RDONLY)
120 /* If immutable bit set, nobody gets to write it. */
121 if ((mode & VWRITE) && (ino_flags & IMMUTABLE))
124 /* Otherwise, user id 0 always gets access. */
130 /* Otherwise, check the owner. */
131 if (proc_uid == ino_uid) {
138 return ((ino_mode & mask) == mask ? 0 : EACCES);
142 * Otherwise, check the groups.
143 * We must special-case the primary group to, if needed, check against
144 * the real gid and not the effective one.
146 if (proc_gid == ino_gid) {
153 return ((ino_mode & mask) == mask ? 0 : EACCES);
155 for (i = 1, gp = &cred->cr_groups[1]; i < cred->cr_ngroups; i++, gp++)
156 if (ino_gid == *gp) {
163 return ((ino_mode & mask) == mask ? 0 : EACCES);
166 /* Otherwise, check everyone else. */
173 return ((ino_mode & mask) == mask ? 0 : EACCES);
177 vop_helper_setattr_flags(u_int32_t *ino_flags, u_int32_t vaflags,
178 uid_t uid, struct ucred *cred)
183 * If uid doesn't match only a privileged user can change the flags
185 if (cred->cr_uid != uid &&
186 (error = priv_check_cred(cred, PRIV_VFS_SYSFLAGS, 0))) {
189 if (cred->cr_uid == 0 &&
190 (!jailed(cred)|| jail_chflags_allowed)) {
191 if ((*ino_flags & (SF_NOUNLINK|SF_IMMUTABLE|SF_APPEND)) &&
194 *ino_flags = vaflags;
196 if (*ino_flags & (SF_NOUNLINK|SF_IMMUTABLE|SF_APPEND) ||
197 (vaflags & UF_SETTABLE) != vaflags)
199 *ino_flags &= SF_SETTABLE;
200 *ino_flags |= vaflags & UF_SETTABLE;
206 * This helper function may be used by VFSs to implement UNIX initial
207 * ownership semantics when creating new objects inside directories.
210 vop_helper_create_uid(struct mount *mp, mode_t dmode, uid_t duid,
211 struct ucred *cred, mode_t *modep)
214 if ((mp->mnt_flag & MNT_SUIDDIR) && (dmode & S_ISUID) &&
215 duid != cred->cr_uid && duid) {
220 return(cred->cr_uid);
224 * This helper may be used by VFSs to implement unix chmod semantics.
227 vop_helper_chmod(struct vnode *vp, mode_t new_mode, struct ucred *cred,
228 uid_t cur_uid, gid_t cur_gid, mode_t *cur_modep)
232 if (cred->cr_uid != cur_uid) {
233 error = priv_check_cred(cred, PRIV_VFS_CHMOD, 0);
238 if (vp->v_type != VDIR && (*cur_modep & S_ISTXT))
240 if (!groupmember(cur_gid, cred) && (*cur_modep & S_ISGID))
243 *cur_modep &= ~ALLPERMS;
244 *cur_modep |= new_mode & ALLPERMS;
249 * This helper may be used by VFSs to implement unix chown semantics.
252 vop_helper_chown(struct vnode *vp, uid_t new_uid, gid_t new_gid,
254 uid_t *cur_uidp, gid_t *cur_gidp, mode_t *cur_modep)
260 if (new_uid == (uid_t)VNOVAL)
262 if (new_gid == (gid_t)VNOVAL)
266 * If we don't own the file, are trying to change the owner
267 * of the file, or are not a member of the target group,
268 * the caller must be privileged or the call fails.
270 if ((cred->cr_uid != *cur_uidp || new_uid != *cur_uidp ||
271 (new_gid != *cur_gidp && !(cred->cr_gid == new_gid ||
272 groupmember(new_gid, cred)))) &&
273 (error = priv_check_cred(cred, PRIV_VFS_CHOWN, 0))) {
284 * DragonFly clears both SUID and SGID if either the owner or
285 * group is changed and root isn't doing it. If root is doing
286 * it we do not clear SUID/SGID.
288 if (cred->cr_uid != 0 && (ouid != new_uid || ogid != new_gid))
289 *cur_modep &= ~(S_ISUID | S_ISGID);
293 #ifdef LWBUF_IS_OPTIMAL
296 * A VFS can call this function to try to dispose of a read request
297 * directly from the VM system, pretty much bypassing almost all VFS
298 * overhead except for atime updates.
300 * If 0 is returned some or all of the uio was handled. The caller must
301 * check the uio and handle the remainder.
303 * The caller must fail on a non-zero error.
306 vop_helper_read_shortcut(struct vop_read_args *ap)
311 struct lwbuf lwb_cache;
322 * We can't short-cut if there is no VM object or this is a special
323 * UIO_NOCOPY read (typically from VOP_STRATEGY()). We also can't
324 * do this if we cannot extract the filesize from the vnode.
326 if (vm_read_shortcut_enable == 0)
328 if (vp->v_object == NULL || uio->uio_segflg == UIO_NOCOPY)
330 if (vp->v_filesize == NOOFFSET)
332 if (uio->uio_resid == 0)
336 * Iterate the uio on a page-by-page basis
338 * XXX can we leave the object held shared during the uiomove()?
340 ++vm_read_shortcut_count;
342 vm_object_hold_shared(obj);
345 while (uio->uio_resid && error == 0) {
346 offset = (int)uio->uio_offset & PAGE_MASK;
347 n = PAGE_SIZE - offset;
348 if (n > uio->uio_resid)
350 if (vp->v_filesize < uio->uio_offset)
352 if (uio->uio_offset + n > vp->v_filesize)
353 n = vp->v_filesize - uio->uio_offset;
357 m = vm_page_lookup_busy_try(obj, OFF_TO_IDX(uio->uio_offset),
359 if (error || m == NULL) {
360 ++vm_read_shortcut_failed;
364 if ((m->valid & VM_PAGE_BITS_ALL) != VM_PAGE_BITS_ALL) {
365 ++vm_read_shortcut_failed;
369 lwb = lwbuf_alloc(m, &lwb_cache);
372 * Use a no-fault uiomove() to avoid deadlocking against
373 * our VM object (which could livelock on the same object
374 * due to shared-vs-exclusive), or deadlocking against
375 * our busied page. Returns EFAULT on any fault which
376 * winds up diving a vnode.
378 error = uiomove_nofault((char *)lwbuf_kva(lwb) + offset,
381 vm_page_flag_set(m, PG_REFERENCED);
388 * Ignore EFAULT since we used uiomove_nofault(), causes caller
389 * to fall-back to normal code for this case.
400 * If lwbuf's aren't optimal then it's best to just use the buffer
404 vop_helper_read_shortcut(struct vop_read_args *ap)