Date: Wed, 12 Dec 2007 23:42:33 GMT From: John Birrell <jb@FreeBSD.org> To: Perforce Change Reviews <perforce@freebsd.org> Subject: PERFORCE change 130759 for review Message-ID: <200712122342.lBCNgXPV089461@repoman.freebsd.org>
next in thread | raw e-mail | index | archive | help
http://perforce.freebsd.org/chv.cgi?CH=130759 Change 130759 by jb@jb_freebsd1 on 2007/12/12 23:41:43 This change contains all FreeBSD changes from the latest OpenSolaris import we have to the sources that are currently in CVS. Luckily we have p4 to merge new changes to OpenSolaris into our code base. If we only had CVS, this would be a nightmare. Affected files ... .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/common/acl/acl_common.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/common/acl/acl_common.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/common/avl/avl.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/common/nvpair/nvpair.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/common/nvpair/nvpair_alloc_fixed.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/common/zfs/zfs_namecheck.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/common/zfs/zfs_namecheck.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/common/zfs/zfs_prop.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/common/zfs/zfs_prop.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/Makefile.files#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/gfs.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/arc.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/bplist.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/dbuf.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/dmu.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/dmu_objset.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/dmu_send.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/dmu_tx.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/dmu_zfetch.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/dnode.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/dnode_sync.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/dsl_dataset.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/dsl_dir.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/dsl_pool.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/dsl_prop.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/dsl_synctask.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/lzjb.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/metaslab.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/refcount.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/spa.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/spa_config.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/spa_errlog.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/spa_history.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/spa_misc.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/space_map.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/arc.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/dbuf.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/dmu.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/dmu_objset.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/dmu_tx.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/dnode.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/dsl_dataset.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/dsl_dir.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/dsl_pool.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/dsl_prop.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/dsl_synctask.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/metaslab.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/refcount.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/spa.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/spa_impl.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/uberblock_impl.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/unique.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/vdev.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/vdev_impl.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/zap.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/zap_impl.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/zap_leaf.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/zfs_acl.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/zfs_context.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/zfs_ctldir.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/zfs_dir.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/zfs_ioctl.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/zfs_vfsops.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/zfs_znode.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/zil.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/zio.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/zio_impl.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/sys/zvol.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/txg.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/unique.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/vdev.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/vdev_cache.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/vdev_disk.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/vdev_file.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/vdev_label.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/vdev_mirror.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/vdev_missing.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/vdev_queue.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/vdev_raidz.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/vdev_root.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/zap.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/zap_leaf.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/zap_micro.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/zfs_acl.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/zfs_byteswap.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/zfs_ctldir.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/zfs_dir.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/zfs_fm.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/zfs_ioctl.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/zfs_log.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/zfs_replay.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/zfs_rlock.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/zfs_vfsops.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/zfs_znode.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/zil.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/zio.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/fs/zfs/zvol.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/os/callb.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/os/list.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/os/nvpair_alloc_system.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/os/taskq.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/rpc/xdr.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/rpc/xdr.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/sys/byteorder.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/sys/callb.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/sys/cred.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/sys/debug.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/sys/dkio.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/sys/feature_tests.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/sys/fm/fs/zfs.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/sys/fm/protocol.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/sys/fm/util.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/sys/fs/zfs.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/sys/gfs.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/sys/isa_defs.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/sys/nvpair.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/sys/processor.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/sys/procset.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/sys/sdt.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/sys/synch.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/sys/sysmacros.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/sys/vmem.h#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/zmod/zmod.c#2 edit .. //depot/projects/opensolaris/src/sys/contrib/opensolaris/uts/common/zmod/zmod_subr.c#2 edit Differences ... ==== //depot/projects/opensolaris/src/sys/contrib/opensolaris/common/acl/acl_common.c#2 (text) ==== @@ -2,8 +2,9 @@ * CDDL HEADER START * * The contents of this file are subject to the terms of the - * Common Development and Distribution License (the "License"). - * You may not use this file except in compliance with the License. + * Common Development and Distribution License, Version 1.0 only + * (the "License"). You may not use this file except in compliance + * with the License. * * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE * or http://www.opensolaris.org/os/licensing. @@ -19,204 +20,78 @@ * CDDL HEADER END */ /* - * Copyright 2007 Sun Microsystems, Inc. All rights reserved. + * Copyright 2005 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #pragma ident "%Z%%M% %I% %E% SMI" #include <sys/types.h> +#include <sys/acl.h> #include <sys/stat.h> -#include <sys/avl.h> #if defined(_KERNEL) #include <sys/systm.h> -#include <sys/sysmacros.h> -#include <acl/acl_common.h> +#include <sys/debug.h> #else #include <errno.h> #include <stdlib.h> -#include <stddef.h> #include <strings.h> -#include <unistd.h> #include <assert.h> -#include <grp.h> -#include <pwd.h> -#include <acl_common.h> #define ASSERT assert #endif -#define ACE_POSIX_SUPPORTED_BITS (ACE_READ_DATA | \ - ACE_WRITE_DATA | ACE_APPEND_DATA | ACE_EXECUTE | \ - ACE_READ_ATTRIBUTES | ACE_READ_ACL | ACE_WRITE_ACL) - - -#define ACL_SYNCHRONIZE_SET_DENY 0x0000001 -#define ACL_SYNCHRONIZE_SET_ALLOW 0x0000002 -#define ACL_SYNCHRONIZE_ERR_DENY 0x0000004 -#define ACL_SYNCHRONIZE_ERR_ALLOW 0x0000008 - -#define ACL_WRITE_OWNER_SET_DENY 0x0000010 -#define ACL_WRITE_OWNER_SET_ALLOW 0x0000020 -#define ACL_WRITE_OWNER_ERR_DENY 0x0000040 -#define ACL_WRITE_OWNER_ERR_ALLOW 0x0000080 - -#define ACL_DELETE_SET_DENY 0x0000100 -#define ACL_DELETE_SET_ALLOW 0x0000200 -#define ACL_DELETE_ERR_DENY 0x0000400 -#define ACL_DELETE_ERR_ALLOW 0x0000800 - -#define ACL_WRITE_ATTRS_OWNER_SET_DENY 0x0001000 -#define ACL_WRITE_ATTRS_OWNER_SET_ALLOW 0x0002000 -#define ACL_WRITE_ATTRS_OWNER_ERR_DENY 0x0004000 -#define ACL_WRITE_ATTRS_OWNER_ERR_ALLOW 0x0008000 - -#define ACL_WRITE_ATTRS_WRITER_SET_DENY 0x0010000 -#define ACL_WRITE_ATTRS_WRITER_SET_ALLOW 0x0020000 -#define ACL_WRITE_ATTRS_WRITER_ERR_DENY 0x0040000 -#define ACL_WRITE_ATTRS_WRITER_ERR_ALLOW 0x0080000 - -#define ACL_WRITE_NAMED_WRITER_SET_DENY 0x0100000 -#define ACL_WRITE_NAMED_WRITER_SET_ALLOW 0x0200000 -#define ACL_WRITE_NAMED_WRITER_ERR_DENY 0x0400000 -#define ACL_WRITE_NAMED_WRITER_ERR_ALLOW 0x0800000 - -#define ACL_READ_NAMED_READER_SET_DENY 0x1000000 -#define ACL_READ_NAMED_READER_SET_ALLOW 0x2000000 -#define ACL_READ_NAMED_READER_ERR_DENY 0x4000000 -#define ACL_READ_NAMED_READER_ERR_ALLOW 0x8000000 - -#define ACE_VALID_MASK_BITS (\ - ACE_READ_DATA | \ - ACE_LIST_DIRECTORY | \ - ACE_WRITE_DATA | \ - ACE_ADD_FILE | \ - ACE_APPEND_DATA | \ - ACE_ADD_SUBDIRECTORY | \ - ACE_READ_NAMED_ATTRS | \ - ACE_WRITE_NAMED_ATTRS | \ - ACE_EXECUTE | \ - ACE_DELETE_CHILD | \ - ACE_READ_ATTRIBUTES | \ - ACE_WRITE_ATTRIBUTES | \ - ACE_DELETE | \ - ACE_READ_ACL | \ - ACE_WRITE_ACL | \ - ACE_WRITE_OWNER | \ - ACE_SYNCHRONIZE) - -#define ACE_MASK_UNDEFINED 0x80000000 - -#define ACE_VALID_FLAG_BITS (ACE_FILE_INHERIT_ACE | \ - ACE_DIRECTORY_INHERIT_ACE | \ - ACE_NO_PROPAGATE_INHERIT_ACE | ACE_INHERIT_ONLY_ACE | \ - ACE_SUCCESSFUL_ACCESS_ACE_FLAG | ACE_FAILED_ACCESS_ACE_FLAG | \ - ACE_IDENTIFIER_GROUP | ACE_OWNER | ACE_GROUP | ACE_EVERYONE) - -/* - * ACL conversion helpers - */ - -typedef enum { - ace_unused, - ace_user_obj, - ace_user, - ace_group, /* includes GROUP and GROUP_OBJ */ - ace_other_obj -} ace_to_aent_state_t; - -typedef struct acevals { - uid_t key; - avl_node_t avl; - uint32_t mask; - uint32_t allowed; - uint32_t denied; - int aent_type; -} acevals_t; - -typedef struct ace_list { - acevals_t user_obj; - avl_tree_t user; - int numusers; - acevals_t group_obj; - avl_tree_t group; - int numgroups; - acevals_t other_obj; - uint32_t acl_mask; - int hasmask; - int dfacl_flag; - ace_to_aent_state_t state; - int seen; /* bitmask of all aclent_t a_type values seen */ -} ace_list_t; - ace_t trivial_acl[] = { - {(uid_t)-1, 0, ACE_OWNER, ACE_ACCESS_DENIED_ACE_TYPE}, - {(uid_t)-1, ACE_WRITE_ACL|ACE_WRITE_OWNER|ACE_WRITE_ATTRIBUTES| + {-1, 0, ACE_OWNER, ACE_ACCESS_DENIED_ACE_TYPE}, + {-1, ACE_WRITE_ACL|ACE_WRITE_OWNER|ACE_WRITE_ATTRIBUTES| ACE_WRITE_NAMED_ATTRS, ACE_OWNER, ACE_ACCESS_ALLOWED_ACE_TYPE}, - {(uid_t)-1, 0, ACE_GROUP|ACE_IDENTIFIER_GROUP, - ACE_ACCESS_DENIED_ACE_TYPE}, - {(uid_t)-1, 0, ACE_GROUP|ACE_IDENTIFIER_GROUP, - ACE_ACCESS_ALLOWED_ACE_TYPE}, - {(uid_t)-1, ACE_WRITE_ACL|ACE_WRITE_OWNER| ACE_WRITE_ATTRIBUTES| + {-1, 0, ACE_GROUP|ACE_IDENTIFIER_GROUP, ACE_ACCESS_DENIED_ACE_TYPE}, + {-1, 0, ACE_GROUP|ACE_IDENTIFIER_GROUP, ACE_ACCESS_ALLOWED_ACE_TYPE}, + {-1, ACE_WRITE_ACL|ACE_WRITE_OWNER| ACE_WRITE_ATTRIBUTES| ACE_WRITE_NAMED_ATTRS, ACE_EVERYONE, ACE_ACCESS_DENIED_ACE_TYPE}, - {(uid_t)-1, ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_READ_NAMED_ATTRS| + {-1, ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_READ_NAMED_ATTRS| ACE_SYNCHRONIZE, ACE_EVERYONE, ACE_ACCESS_ALLOWED_ACE_TYPE} }; void -adjust_ace_pair_common(void *pair, size_t access_off, - size_t pairsize, mode_t mode) +adjust_ace_pair(ace_t *pair, mode_t mode) { - char *datap = (char *)pair; - uint32_t *amask0 = (uint32_t *)(uintptr_t)(datap + access_off); - uint32_t *amask1 = (uint32_t *)(uintptr_t)(datap + pairsize + - access_off); if (mode & S_IROTH) - *amask1 |= ACE_READ_DATA; + pair[1].a_access_mask |= ACE_READ_DATA; else - *amask0 |= ACE_READ_DATA; + pair[0].a_access_mask |= ACE_READ_DATA; if (mode & S_IWOTH) - *amask1 |= ACE_WRITE_DATA|ACE_APPEND_DATA; + pair[1].a_access_mask |= + ACE_WRITE_DATA|ACE_APPEND_DATA; else - *amask0 |= ACE_WRITE_DATA|ACE_APPEND_DATA; + pair[0].a_access_mask |= + ACE_WRITE_DATA|ACE_APPEND_DATA; if (mode & S_IXOTH) - *amask1 |= ACE_EXECUTE; + pair[1].a_access_mask |= ACE_EXECUTE; else - *amask0 |= ACE_EXECUTE; -} - -void -adjust_ace_pair(ace_t *pair, mode_t mode) -{ - adjust_ace_pair_common(pair, offsetof(ace_t, a_access_mask), - sizeof (ace_t), mode); + pair[0].a_access_mask |= ACE_EXECUTE; } /* * ace_trivial: * determine whether an ace_t acl is trivial * - * Trivialness implies that the acl is composed of only + * Trivialness implys that the acl is composed of only * owner, group, everyone entries. ACL can't * have read_acl denied, and write_owner/write_acl/write_attributes * can only be owner@ entry. */ int -ace_trivial_common(void *acep, int aclcnt, - uint64_t (*walk)(void *, uint64_t, int aclcnt, - uint16_t *, uint16_t *, uint32_t *)) +ace_trivial(ace_t *acep, int aclcnt) { + int i; int owner_seen = 0; int group_seen = 0; int everyone_seen = 0; - uint16_t flags; - uint32_t mask; - uint16_t type; - uint64_t cookie = 0; - while (cookie = walk(acep, cookie, aclcnt, &flags, &type, &mask)) { - switch (flags & ACE_TYPE_FLAGS) { + for (i = 0; i != aclcnt; i++) { + switch (acep[i].a_flags & 0xf040) { case ACE_OWNER: if (group_seen || everyone_seen) return (1); @@ -238,7 +113,7 @@ } - if (flags & (ACE_FILE_INHERIT_ACE| + if (acep[i].a_flags & (ACE_FILE_INHERIT_ACE| ACE_DIRECTORY_INHERIT_ACE|ACE_NO_PROPAGATE_INHERIT_ACE| ACE_INHERIT_ONLY_ACE)) return (1); @@ -249,48 +124,27 @@ * Don't allow anybody to deny reading basic * attributes or a files ACL. */ - if ((mask & (ACE_READ_ACL|ACE_READ_ATTRIBUTES)) && - (type == ACE_ACCESS_DENIED_ACE_TYPE)) + if ((acep[i].a_access_mask & + (ACE_READ_ACL|ACE_READ_ATTRIBUTES)) && + (acep[i].a_type == ACE_ACCESS_DENIED_ACE_TYPE)) return (1); /* * Allow on owner@ to allow * write_acl/write_owner/write_attributes */ - if (type == ACE_ACCESS_ALLOWED_ACE_TYPE && - (!(flags & ACE_OWNER) && (mask & + if (acep[i].a_type == ACE_ACCESS_ALLOWED_ACE_TYPE && + (!(acep[i].a_flags & ACE_OWNER) && (acep[i].a_access_mask & (ACE_WRITE_OWNER|ACE_WRITE_ACL|ACE_WRITE_ATTRIBUTES)))) return (1); - } if ((owner_seen == 0) || (group_seen == 0) || (everyone_seen == 0)) - return (1); + return (1); return (0); } -uint64_t -ace_walk(void *datap, uint64_t cookie, int aclcnt, uint16_t *flags, - uint16_t *type, uint32_t *mask) -{ - ace_t *acep = datap; - - *flags = acep[cookie].a_flags; - *type = acep[cookie].a_type; - *mask = acep[cookie++].a_access_mask; - - if (cookie > aclcnt) - return (0); - else - return (cookie); -} - -int -ace_trivial(ace_t *acep, int aclcnt) -{ - return (ace_trivial_common(acep, aclcnt, ace_walk)); -} /* * Generic shellsort, from K&R (1st ed, p 58.), somewhat modified. @@ -317,8 +171,8 @@ for (g = n / 2; g > 0; g /= 2) { for (i = g; i < n; i++) { for (j = i - g; j >= 0 && - (*f)(v + j * s, v + (j + g) * s) == 1; - j -= g) { + (*f)(v + j * s, v + (j + g) * s) == 1; + j -= g) { p1 = (void *)(v + j * s); p2 = (void *)(v + (j + g) * s); for (ii = 0; ii < s / 4; ii++) { @@ -361,1347 +215,3 @@ /* Totally equal */ return (0); } - -/*ARGSUSED*/ -static void * -cacl_realloc(void *ptr, size_t size, size_t new_size) -{ -#if defined(_KERNEL) - void *tmp; - - tmp = kmem_alloc(new_size, KM_SLEEP); - (void) memcpy(tmp, ptr, (size < new_size) ? size : new_size); - kmem_free(ptr, size); - return (tmp); -#else - return (realloc(ptr, new_size)); -#endif -} - -static int -cacl_malloc(void **ptr, size_t size) -{ -#if defined(_KERNEL) - *ptr = kmem_zalloc(size, KM_SLEEP); - return (0); -#else - *ptr = calloc(1, size); - if (*ptr == NULL) - return (errno); - - return (0); -#endif -} - -/*ARGSUSED*/ -static void -cacl_free(void *ptr, size_t size) -{ -#if defined(_KERNEL) - kmem_free(ptr, size); -#else - free(ptr); -#endif -} - -acl_t * -acl_alloc(enum acl_type type) -{ - acl_t *aclp; - - if (cacl_malloc((void **)&aclp, sizeof (acl_t)) != 0) - return (NULL); - - aclp->acl_aclp = NULL; - aclp->acl_cnt = 0; - - switch (type) { - case ACE_T: - aclp->acl_type = ACE_T; - aclp->acl_entry_size = sizeof (ace_t); - break; - case ACLENT_T: - aclp->acl_type = ACLENT_T; - aclp->acl_entry_size = sizeof (aclent_t); - break; - default: - acl_free(aclp); - aclp = NULL; - } - return (aclp); -} - -/* - * Free acl_t structure - */ -void -acl_free(acl_t *aclp) -{ - int acl_size; - - if (aclp == NULL) - return; - - if (aclp->acl_aclp) { - acl_size = aclp->acl_cnt * aclp->acl_entry_size; - cacl_free(aclp->acl_aclp, acl_size); - } - - cacl_free(aclp, sizeof (acl_t)); -} - -static uint32_t -access_mask_set(int haswriteperm, int hasreadperm, int isowner, int isallow) -{ - uint32_t access_mask = 0; - int acl_produce; - int synchronize_set = 0, write_owner_set = 0; - int delete_set = 0, write_attrs_set = 0; - int read_named_set = 0, write_named_set = 0; - - acl_produce = (ACL_SYNCHRONIZE_SET_ALLOW | - ACL_WRITE_ATTRS_OWNER_SET_ALLOW | - ACL_WRITE_ATTRS_WRITER_SET_DENY); - - if (isallow) { - synchronize_set = ACL_SYNCHRONIZE_SET_ALLOW; - write_owner_set = ACL_WRITE_OWNER_SET_ALLOW; - delete_set = ACL_DELETE_SET_ALLOW; - if (hasreadperm) - read_named_set = ACL_READ_NAMED_READER_SET_ALLOW; - if (haswriteperm) - write_named_set = ACL_WRITE_NAMED_WRITER_SET_ALLOW; - if (isowner) - write_attrs_set = ACL_WRITE_ATTRS_OWNER_SET_ALLOW; - else if (haswriteperm) - write_attrs_set = ACL_WRITE_ATTRS_WRITER_SET_ALLOW; - } else { - - synchronize_set = ACL_SYNCHRONIZE_SET_DENY; - write_owner_set = ACL_WRITE_OWNER_SET_DENY; - delete_set = ACL_DELETE_SET_DENY; - if (hasreadperm) - read_named_set = ACL_READ_NAMED_READER_SET_DENY; - if (haswriteperm) - write_named_set = ACL_WRITE_NAMED_WRITER_SET_DENY; - if (isowner) - write_attrs_set = ACL_WRITE_ATTRS_OWNER_SET_DENY; - else if (haswriteperm) - write_attrs_set = ACL_WRITE_ATTRS_WRITER_SET_DENY; - else - /* - * If the entity is not the owner and does not - * have write permissions ACE_WRITE_ATTRIBUTES will - * always go in the DENY ACE. - */ - access_mask |= ACE_WRITE_ATTRIBUTES; - } - - if (acl_produce & synchronize_set) - access_mask |= ACE_SYNCHRONIZE; - if (acl_produce & write_owner_set) - access_mask |= ACE_WRITE_OWNER; - if (acl_produce & delete_set) - access_mask |= ACE_DELETE; - if (acl_produce & write_attrs_set) - access_mask |= ACE_WRITE_ATTRIBUTES; - if (acl_produce & read_named_set) - access_mask |= ACE_READ_NAMED_ATTRS; - if (acl_produce & write_named_set) - access_mask |= ACE_WRITE_NAMED_ATTRS; - - return (access_mask); -} - -/* - * Given an mode_t, convert it into an access_mask as used - * by nfsace, assuming aclent_t -> nfsace semantics. - */ -static uint32_t -mode_to_ace_access(mode_t mode, int isdir, int isowner, int isallow) -{ - uint32_t access = 0; - int haswriteperm = 0; - int hasreadperm = 0; - - if (isallow) { - haswriteperm = (mode & S_IWOTH); - hasreadperm = (mode & S_IROTH); - } else { - haswriteperm = !(mode & S_IWOTH); - hasreadperm = !(mode & S_IROTH); - } - - /* - * The following call takes care of correctly setting the following - * mask bits in the access_mask: - * ACE_SYNCHRONIZE, ACE_WRITE_OWNER, ACE_DELETE, - * ACE_WRITE_ATTRIBUTES, ACE_WRITE_NAMED_ATTRS, ACE_READ_NAMED_ATTRS - */ - access = access_mask_set(haswriteperm, hasreadperm, isowner, isallow); - - if (isallow) { - access |= ACE_READ_ACL | ACE_READ_ATTRIBUTES; - if (isowner) - access |= ACE_WRITE_ACL; - } else { - if (! isowner) - access |= ACE_WRITE_ACL; - } - - /* read */ - if (mode & S_IROTH) { - access |= ACE_READ_DATA; - } - /* write */ - if (mode & S_IWOTH) { - access |= ACE_WRITE_DATA | - ACE_APPEND_DATA; - if (isdir) - access |= ACE_DELETE_CHILD; - } - /* exec */ - if (mode & 01) { - access |= ACE_EXECUTE; - } - - return (access); -} - -/* - * Given an nfsace (presumably an ALLOW entry), make a - * corresponding DENY entry at the address given. - */ -static void -ace_make_deny(ace_t *allow, ace_t *deny, int isdir, int isowner) -{ - (void) memcpy(deny, allow, sizeof (ace_t)); - - deny->a_who = allow->a_who; - - deny->a_type = ACE_ACCESS_DENIED_ACE_TYPE; - deny->a_access_mask ^= ACE_POSIX_SUPPORTED_BITS; - if (isdir) - deny->a_access_mask ^= ACE_DELETE_CHILD; - - deny->a_access_mask &= ~(ACE_SYNCHRONIZE | ACE_WRITE_OWNER | - ACE_DELETE | ACE_WRITE_ATTRIBUTES | ACE_READ_NAMED_ATTRS | - ACE_WRITE_NAMED_ATTRS); - deny->a_access_mask |= access_mask_set((allow->a_access_mask & - ACE_WRITE_DATA), (allow->a_access_mask & ACE_READ_DATA), isowner, - B_FALSE); -} -/* - * Make an initial pass over an array of aclent_t's. Gather - * information such as an ACL_MASK (if any), number of users, - * number of groups, and whether the array needs to be sorted. - */ -static int -ln_aent_preprocess(aclent_t *aclent, int n, - int *hasmask, mode_t *mask, - int *numuser, int *numgroup, int *needsort) -{ - int error = 0; - int i; - int curtype = 0; - - *hasmask = 0; - *mask = 07; - *needsort = 0; - *numuser = 0; - *numgroup = 0; - - for (i = 0; i < n; i++) { - if (aclent[i].a_type < curtype) - *needsort = 1; - else if (aclent[i].a_type > curtype) - curtype = aclent[i].a_type; - if (aclent[i].a_type & USER) - (*numuser)++; - if (aclent[i].a_type & (GROUP | GROUP_OBJ)) - (*numgroup)++; - if (aclent[i].a_type & CLASS_OBJ) { - if (*hasmask) { - error = EINVAL; - goto out; - } else { - *hasmask = 1; - *mask = aclent[i].a_perm; - } - } - } - - if ((! *hasmask) && (*numuser + *numgroup > 1)) { - error = EINVAL; - goto out; - } - -out: - return (error); -} - -/* - * Convert an array of aclent_t into an array of nfsace entries, - * following POSIX draft -> nfsv4 conversion semantics as outlined in - * the IETF draft. - */ -static int -ln_aent_to_ace(aclent_t *aclent, int n, ace_t **acepp, int *rescount, int isdir) -{ - int error = 0; - mode_t mask; - int numuser, numgroup, needsort; - int resultsize = 0; - int i, groupi = 0, skip; - ace_t *acep, *result = NULL; - int hasmask; - - error = ln_aent_preprocess(aclent, n, &hasmask, &mask, - &numuser, &numgroup, &needsort); - if (error != 0) - goto out; - - /* allow + deny for each aclent */ - resultsize = n * 2; - if (hasmask) { - /* - * stick extra deny on the group_obj and on each - * user|group for the mask (the group_obj was added - * into the count for numgroup) - */ - resultsize += numuser + numgroup; - /* ... and don't count the mask itself */ - resultsize -= 2; - } - - /* sort the source if necessary */ - if (needsort) - ksort((caddr_t)aclent, n, sizeof (aclent_t), cmp2acls); - - if (cacl_malloc((void **)&result, resultsize * sizeof (ace_t)) != 0) - goto out; - - acep = result; - - for (i = 0; i < n; i++) { - /* - * don't process CLASS_OBJ (mask); mask was grabbed in - * ln_aent_preprocess() - */ - if (aclent[i].a_type & CLASS_OBJ) - continue; - - /* If we need an ACL_MASK emulator, prepend it now */ - if ((hasmask) && - (aclent[i].a_type & (USER | GROUP | GROUP_OBJ))) { - acep->a_type = ACE_ACCESS_DENIED_ACE_TYPE; - acep->a_flags = 0; - if (aclent[i].a_type & GROUP_OBJ) { - acep->a_who = (uid_t)-1; - acep->a_flags |= - (ACE_IDENTIFIER_GROUP|ACE_GROUP); - } else if (aclent[i].a_type & USER) { - acep->a_who = aclent[i].a_id; - } else { - acep->a_who = aclent[i].a_id; - acep->a_flags |= ACE_IDENTIFIER_GROUP; - } - if (aclent[i].a_type & ACL_DEFAULT) { - acep->a_flags |= ACE_INHERIT_ONLY_ACE | - ACE_FILE_INHERIT_ACE | - ACE_DIRECTORY_INHERIT_ACE; - } - /* - * Set the access mask for the prepended deny - * ace. To do this, we invert the mask (found - * in ln_aent_preprocess()) then convert it to an - * DENY ace access_mask. - */ - acep->a_access_mask = mode_to_ace_access((mask ^ 07), - isdir, 0, 0); - acep += 1; - } - - /* handle a_perm -> access_mask */ - acep->a_access_mask = mode_to_ace_access(aclent[i].a_perm, - isdir, aclent[i].a_type & USER_OBJ, 1); - - /* emulate a default aclent */ - if (aclent[i].a_type & ACL_DEFAULT) { - acep->a_flags |= ACE_INHERIT_ONLY_ACE | - ACE_FILE_INHERIT_ACE | - ACE_DIRECTORY_INHERIT_ACE; - } - - /* - * handle a_perm and a_id - * - * this must be done last, since it involves the - * corresponding deny aces, which are handled - * differently for each different a_type. - */ - if (aclent[i].a_type & USER_OBJ) { - acep->a_who = (uid_t)-1; - acep->a_flags |= ACE_OWNER; - ace_make_deny(acep, acep + 1, isdir, B_TRUE); - acep += 2; - } else if (aclent[i].a_type & USER) { - acep->a_who = aclent[i].a_id; - ace_make_deny(acep, acep + 1, isdir, B_FALSE); - acep += 2; - } else if (aclent[i].a_type & (GROUP_OBJ | GROUP)) { - if (aclent[i].a_type & GROUP_OBJ) { - acep->a_who = (uid_t)-1; - acep->a_flags |= ACE_GROUP; - } else { - acep->a_who = aclent[i].a_id; - } - acep->a_flags |= ACE_IDENTIFIER_GROUP; - /* - * Set the corresponding deny for the group ace. - * - * The deny aces go after all of the groups, unlike - * everything else, where they immediately follow - * the allow ace. - * - * We calculate "skip", the number of slots to - * skip ahead for the deny ace, here. - * - * The pattern is: - * MD1 A1 MD2 A2 MD3 A3 D1 D2 D3 - * thus, skip is - * (2 * numgroup) - 1 - groupi - * (2 * numgroup) to account for MD + A - * - 1 to account for the fact that we're on the - * access (A), not the mask (MD) - * - groupi to account for the fact that we have - * passed up groupi number of MD's. - */ - skip = (2 * numgroup) - 1 - groupi; - ace_make_deny(acep, acep + skip, isdir, B_FALSE); - /* - * If we just did the last group, skip acep past - * all of the denies; else, just move ahead one. - */ - if (++groupi >= numgroup) - acep += numgroup + 1; - else - acep += 1; - } else if (aclent[i].a_type & OTHER_OBJ) { - acep->a_who = (uid_t)-1; - acep->a_flags |= ACE_EVERYONE; - ace_make_deny(acep, acep + 1, isdir, B_FALSE); - acep += 2; - } else { - error = EINVAL; - goto out; - } - } - - *acepp = result; - *rescount = resultsize; - -out: - if (error != 0) { - if ((result != NULL) && (resultsize > 0)) { - cacl_free(result, resultsize * sizeof (ace_t)); - } - } - - return (error); -} - -static int -convert_aent_to_ace(aclent_t *aclentp, int aclcnt, int isdir, - ace_t **retacep, int *retacecnt) -{ - ace_t *acep; - ace_t *dfacep; - int acecnt = 0; - int dfacecnt = 0; - int dfaclstart = 0; - int dfaclcnt = 0; - aclent_t *aclp; - int i; - int error; - int acesz, dfacesz; - - ksort((caddr_t)aclentp, aclcnt, sizeof (aclent_t), cmp2acls); - - for (i = 0, aclp = aclentp; i < aclcnt; aclp++, i++) { - if (aclp->a_type & ACL_DEFAULT) - break; - } - - if (i < aclcnt) { - dfaclstart = i; - dfaclcnt = aclcnt - i; - } - - if (dfaclcnt && isdir == 0) { - return (EINVAL); - } - - error = ln_aent_to_ace(aclentp, i, &acep, &acecnt, isdir); - if (error) - return (error); - - if (dfaclcnt) { - error = ln_aent_to_ace(&aclentp[dfaclstart], dfaclcnt, - &dfacep, &dfacecnt, isdir); - if (error) { - if (acep) { - cacl_free(acep, acecnt * sizeof (ace_t)); - } - return (error); - } - } - - if (dfacecnt != 0) { - acesz = sizeof (ace_t) * acecnt; - dfacesz = sizeof (ace_t) * dfacecnt; - acep = cacl_realloc(acep, acesz, acesz + dfacesz); - if (acep == NULL) - return (ENOMEM); - if (dfaclcnt) { - (void) memcpy(acep + acecnt, dfacep, dfacesz); - } - } - if (dfaclcnt) - cacl_free(dfacep, dfacecnt * sizeof (ace_t)); - - *retacecnt = acecnt + dfacecnt; - *retacep = acep; - return (0); -} - -static int -ace_mask_to_mode(uint32_t mask, o_mode_t *modep, int isdir) -{ - int error = 0; - o_mode_t mode = 0; - uint32_t bits, wantbits; - - /* read */ - if (mask & ACE_READ_DATA) - mode |= S_IROTH; - - /* write */ - wantbits = (ACE_WRITE_DATA | ACE_APPEND_DATA); - if (isdir) - wantbits |= ACE_DELETE_CHILD; - bits = mask & wantbits; - if (bits != 0) { - if (bits != wantbits) { - error = ENOTSUP; - goto out; - } - mode |= S_IWOTH; - } - - /* exec */ - if (mask & ACE_EXECUTE) { - mode |= S_IXOTH; >>> TRUNCATED FOR MAIL (1000 lines) <<<
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200712122342.lBCNgXPV089461>