mirror/freebsd
1
0
Fork 0
mirror of https://git.FreeBSD.org/src.git synced 2025-01-14 14:55:41 +00:00
Code Issues Releases Activity
main
freebsd/contrib/lib9p/backend/fs.c
Jakub Wojciech Klama 134e17798c Import lib9p 7ddb1164407da19b9b1afb83df83ae65a71a9a66. 
Approved by:	trasz
MFC after:	1 month
Sponsored by:	Conclusive Engineering (development), vStack.com (funding)
2020-05-14 19:57:52 +00:00

3062 lines
76 KiB
C
Raw Permalink Blame History

/*
* Copyright 2016 Jakub Klama <jceel@FreeBSD.org>
* All rights reserved
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted providing that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
* WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
* DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING
* IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*
*/
/*
* Based on libixp code: ©2007-2010 Kris Maglione <maglione.k at Gmail>
*/
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <stdbool.h>
#include <fcntl.h>
#include <errno.h>
#include <assert.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/mount.h>
#include <sys/param.h>
#include <sys/queue.h>
#include <sys/socket.h>
#include <sys/un.h>
#include <dirent.h>
#include <pwd.h>
#include <grp.h>
#include <libgen.h>
#include <pthread.h>
#include "../lib9p.h"
#include "../lib9p_impl.h"
#include "../fid.h"
#include "../log.h"
#include "../rfuncs.h"
#include "../genacl.h"
#include "backend.h"
#include "fs.h"
#if defined(WITH_CASPER)
#include <libcasper.h>
#include <casper/cap_pwd.h>
#include <casper/cap_grp.h>
#endif
#if defined(__FreeBSD__)
#include <sys/param.h>
#if __FreeBSD_version >= 1000000
#define HAVE_BINDAT
#endif
#endif
#if defined(__FreeBSD__)
#define HAVE_BIRTHTIME
#endif
#if defined(__APPLE__)
#include <sys/syscall.h>
#include "Availability.h"
#define ACL_TYPE_NFS4 ACL_TYPE_EXTENDED
#endif
struct fs_softc {
int fs_rootfd;
bool fs_readonly;
#if defined(WITH_CASPER)
cap_channel_t *fs_cappwd;
cap_channel_t *fs_capgrp;
#endif
};
struct fs_fid {
DIR *ff_dir;
int ff_dirfd;
int ff_fd;
int ff_flags;
char *ff_name;
struct fs_authinfo *ff_ai;
pthread_mutex_t ff_mtx;
struct l9p_acl *ff_acl; /* cached ACL if any */
};
#define FF_NO_NFSV4_ACL 0x01 /* don't go looking for NFSv4 ACLs */
/* FF_NO_POSIX_ACL 0x02 -- not yet */
/*
* Our authinfo consists of:
*
* - a reference count
* - a uid
* - a gid-set
*
* The "default" gid is the first gid in the git-set, provided the
* set size is at least 1. The set-size may be zero, though.
*
* Adjustments to the ref-count must be atomic, once it's shared.
* It would be nice to use C11 atomics here but they are not common
* enough to all systems just yet; for now, we use a mutex.
*
* Note that some ops (Linux style ones) pass an effective gid for
* the op, in which case, that gid may override. To achieve this
* effect, permissions testing functions also take an extra gid.
* If this gid is (gid_t)-1 it is not used and only the remaining
* gids take part.
*
* The uid may also be (uid_t)-1, meaning "no uid was available
* at all at attach time". In this case, new files inherit parent
* directory uids.
*
* The refcount is simply the number of "openfile"s using this
* authinfo (so that when the last ref goes away, we can free it).
*
* There are also master ACL flags (same as in ff_flags).
*/
struct fs_authinfo {
pthread_mutex_t ai_mtx; /* lock for refcnt */
uint32_t ai_refcnt;
int ai_flags;
uid_t ai_uid;
int ai_ngids;
gid_t ai_gids[]; /* NB: flexible array member */
};
/*
* We have a global-static mutex for single-threading Tattach
* requests, which use getpwnam (and indirectly, getgr* functions)
* which are not reentrant.
*/
static bool fs_attach_mutex_inited;
static pthread_mutex_t fs_attach_mutex;
/*
* Internal functions (except inline functions).
*/
static struct passwd *fs_getpwuid(struct fs_softc *, uid_t, struct r_pgdata *);
static struct group *fs_getgrgid(struct fs_softc *, gid_t, struct r_pgdata *);
static int fs_buildname(struct l9p_fid *, char *, char *, size_t);
static int fs_pdir(struct fs_softc *, struct l9p_fid *, char *, size_t,
struct stat *st);
static int fs_dpf(char *, char *, size_t);
static int fs_oflags_dotu(int, int *);
static int fs_oflags_dotl(uint32_t, int *, enum l9p_omode *);
static int fs_nde(struct fs_softc *, struct l9p_fid *, bool, gid_t,
struct stat *, uid_t *, gid_t *);
static struct fs_fid *open_fid(int, const char *, struct fs_authinfo *, bool);
static void dostat(struct fs_softc *, struct l9p_stat *, char *,
struct stat *, bool dotu);
static void dostatfs(struct l9p_statfs *, struct statfs *, long);
static void fillacl(struct fs_fid *ff);
static struct l9p_acl *getacl(struct fs_fid *ff, int fd, const char *path);
static void dropacl(struct fs_fid *ff);
static struct l9p_acl *look_for_nfsv4_acl(struct fs_fid *ff, int fd,
const char *path);
static int check_access(int32_t,
struct l9p_acl *, struct stat *, struct l9p_acl *, struct stat *,
struct fs_authinfo *, gid_t);
static void generate_qid(struct stat *, struct l9p_qid *);
static int fs_icreate(void *, struct l9p_fid *, char *, int,
bool, mode_t, gid_t, struct stat *);
static int fs_iopen(void *, struct l9p_fid *, int, enum l9p_omode,
gid_t, struct stat *);
static int fs_imkdir(void *, struct l9p_fid *, char *,
bool, mode_t, gid_t, struct stat *);
static int fs_imkfifo(void *, struct l9p_fid *, char *,
bool, mode_t, gid_t, struct stat *);
static int fs_imknod(void *, struct l9p_fid *, char *,
bool, mode_t, dev_t, gid_t, struct stat *);
static int fs_imksocket(void *, struct l9p_fid *, char *,
bool, mode_t, gid_t, struct stat *);
static int fs_isymlink(void *, struct l9p_fid *, char *, char *,
gid_t, struct stat *);
/*
* Internal functions implementing backend.
*/
static int fs_attach(void *, struct l9p_request *);
static int fs_clunk(void *, struct l9p_fid *);
static int fs_create(void *, struct l9p_request *);
static int fs_open(void *, struct l9p_request *);
static int fs_read(void *, struct l9p_request *);
static int fs_remove(void *, struct l9p_fid *);
static int fs_stat(void *, struct l9p_request *);
static int fs_walk(void *, struct l9p_request *);
static int fs_write(void *, struct l9p_request *);
static int fs_wstat(void *, struct l9p_request *);
static int fs_statfs(void *, struct l9p_request *);
static int fs_lopen(void *, struct l9p_request *);
static int fs_lcreate(void *, struct l9p_request *);
static int fs_symlink(void *, struct l9p_request *);
static int fs_mknod(void *, struct l9p_request *);
static int fs_rename(void *, struct l9p_request *);
static int fs_readlink(void *, struct l9p_request *);
static int fs_getattr(void *, struct l9p_request *);
static int fs_setattr(void *, struct l9p_request *);
static int fs_xattrwalk(void *, struct l9p_request *);
static int fs_xattrcreate(void *, struct l9p_request *);
static int fs_readdir(void *, struct l9p_request *);
static int fs_fsync(void *, struct l9p_request *);
static int fs_lock(void *, struct l9p_request *);
static int fs_getlock(void *, struct l9p_request *);
static int fs_link(void *, struct l9p_request *);
static int fs_renameat(void *, struct l9p_request *);
static int fs_unlinkat(void *, struct l9p_request *);
static void fs_freefid(void *, struct l9p_fid *);
/*
* Convert from 9p2000 open/create mode to Unix-style O_* flags.
* This includes 9p2000.u extensions, but not 9p2000.L protocol,
* which has entirely different open, create, etc., flag bits.
*
* The <mode> given here is the one-byte (uint8_t) "mode"
* argument to Tcreate or Topen, so it can have at most 8 bits.
*
* https://swtch.com/plan9port/man/man9/open.html and
* http://plan9.bell-labs.com/magic/man2html/5/open
* both say:
*
* The [low two bits of the] mode field determines the
* type of I/O ... [I]f mode has the OTRUNC (0x10) bit
* set, the file is to be truncated, which requires write
* permission ...; if the mode has the ORCLOSE (0x40) bit
* set, the file is to be removed when the fid is clunked,
* which requires permission to remove the file from its
* directory. All other bits in mode should be zero. It
* is illegal to write a directory, truncate it, or
* attempt to remove it on close.
*
* 9P2000.u may add ODIRECT (0x80); this is not completely clear.
* The fcall.h header defines OCEXEC (0x20) as well, but it makes
* no sense to send this to a server. There seem to be no bits
* 0x04 and 0x08.
*
* We always turn on O_NOCTTY since as a server, we never want
* to gain a controlling terminal. We always turn on O_NOFOLLOW
* for reasons described elsewhere.
*/
static int
fs_oflags_dotu(int mode, int *aflags)
{
int flags;
#define CONVERT(theirs, ours) \
do { \
if (mode & (theirs)) { \
mode &= ~(theirs); \
flags |= ours; \
} \
} while (0)
switch (mode & L9P_OACCMODE) {
case L9P_OREAD:
default:
flags = O_RDONLY;
break;
case L9P_OWRITE:
flags = O_WRONLY;
break;
case L9P_ORDWR:
flags = O_RDWR;
break;
case L9P_OEXEC:
if (mode & L9P_OTRUNC)
return (EINVAL);
flags = O_RDONLY;
break;
}
flags |= O_NOCTTY | O_NOFOLLOW;
CONVERT(L9P_OTRUNC, O_TRUNC);
/*
* Now take away some flags locally:
* the access mode (already translated)
* ORCLOSE - caller only
* OCEXEC - makes no sense in server
* ODIRECT - not applicable here
* If there are any flag bits left after this,
* we were unable to translate them. For now, let's
* treat this as EINVAL so that we can catch problems.
*/
mode &= ~(L9P_OACCMODE | L9P_ORCLOSE | L9P_OCEXEC | L9P_ODIRECT);
if (mode != 0) {
L9P_LOG(L9P_INFO,
"fs_oflags_dotu: untranslated bits: %#x",
(unsigned)mode);
return (EINVAL);
}
*aflags = flags;
return (0);
#undef CONVERT
}
/*
* Convert from 9P2000.L (Linux) open mode bits to O_* flags.
* See fs_oflags_dotu above.
*
* Linux currently does not have open-for-exec, but there is a
* proposal for it using O_PATH|O_NOFOLLOW, now handled here.
*
* We may eventually also set L9P_ORCLOSE for L_O_TMPFILE.
*/
static int
fs_oflags_dotl(uint32_t l_mode, int *aflags, enum l9p_omode *ap9)
{
int flags;
enum l9p_omode p9;
#define CLEAR(theirs) l_mode &= ~(uint32_t)(theirs)
#define CONVERT(theirs, ours) \
do { \
if (l_mode & (theirs)) { \
CLEAR(theirs); \
flags |= ours; \
} \
} while (0)
/*
* Linux O_RDONLY, O_WRONLY, O_RDWR (0,1,2) match BSD/MacOS.
*/
flags = l_mode & O_ACCMODE;
if (flags == 3)
return (EINVAL);
CLEAR(O_ACCMODE);
if ((l_mode & (L9P_L_O_PATH | L9P_L_O_NOFOLLOW)) ==
(L9P_L_O_PATH | L9P_L_O_NOFOLLOW)) {
CLEAR(L9P_L_O_PATH | L9P_L_O_NOFOLLOW);
p9 = L9P_OEXEC;
} else {
/*
* Slightly dirty, but same dirt, really, as
* setting flags from l_mode & O_ACCMODE.
*/
p9 = (enum l9p_omode)flags; /* slightly dirty */
}
/* turn L_O_TMPFILE into L9P_ORCLOSE in *p9? */
if (l_mode & L9P_L_O_TRUNC)
p9 |= L9P_OTRUNC; /* but don't CLEAR yet */
flags |= O_NOCTTY | O_NOFOLLOW;
/*
* L_O_CREAT seems to be noise, since we get separate open
* and create. But it is actually set sometimes. We just
* throw it out here; create ops must set it themselves and
* open ops have no permissions bits and hence cannot create.
*
* L_O_EXCL does make sense on create ops, i.e., we can
* take a create op with or without L_O_EXCL. We pass that
* through.
*/
CLEAR(L9P_L_O_CREAT);
CONVERT(L9P_L_O_EXCL, O_EXCL);
CONVERT(L9P_L_O_TRUNC, O_TRUNC);
CONVERT(L9P_L_O_DIRECTORY, O_DIRECTORY);
CONVERT(L9P_L_O_APPEND, O_APPEND);
CONVERT(L9P_L_O_NONBLOCK, O_NONBLOCK);
/*
* Discard these as useless noise at our (server) end.
* (NOATIME might be useful but we can only set it on a
* per-mount basis.)
*/
CLEAR(L9P_L_O_CLOEXEC);
CLEAR(L9P_L_O_DIRECT);
CLEAR(L9P_L_O_DSYNC);
CLEAR(L9P_L_O_FASYNC);
CLEAR(L9P_L_O_LARGEFILE);
CLEAR(L9P_L_O_NOATIME);
CLEAR(L9P_L_O_NOCTTY);
CLEAR(L9P_L_O_NOFOLLOW);
CLEAR(L9P_L_O_SYNC);
if (l_mode != 0) {
L9P_LOG(L9P_INFO,
"fs_oflags_dotl: untranslated bits: %#x",
(unsigned)l_mode);
return (EINVAL);
}
*aflags = flags;
*ap9 = p9;
return (0);
#undef CLEAR
#undef CONVERT
}
static struct passwd *
fs_getpwuid(struct fs_softc *sc, uid_t uid, struct r_pgdata *pg)
{
#if defined(WITH_CASPER)
return (r_cap_getpwuid(sc->fs_cappwd, uid, pg));
#else
(void)sc;
return (r_getpwuid(uid, pg));
#endif
}
static struct group *
fs_getgrgid(struct fs_softc *sc, gid_t gid, struct r_pgdata *pg)
{
#if defined(WITH_CASPER)
return (r_cap_getgrgid(sc->fs_capgrp, gid, pg));
#else
(void)sc;
return (r_getgrgid(gid, pg));
#endif
}
/*
* Build full name of file by appending given name to directory name.
*/
static int
fs_buildname(struct l9p_fid *dir, char *name, char *buf, size_t size)
{
struct fs_fid *dirf = dir->lo_aux;
size_t dlen, nlen1;
assert(dirf != NULL);
dlen = strlen(dirf->ff_name);
nlen1 = strlen(name) + 1; /* +1 for '\0' */
if (dlen + 1 + nlen1 > size)
return (ENAMETOOLONG);
memcpy(buf, dirf->ff_name, dlen);
buf[dlen] = '/';
memcpy(buf + dlen + 1, name, nlen1);
return (0);
}
/*
* Build parent name of file by splitting it off. Return an error
* if the given fid represents the root, so that there is no such
* parent, or if the discovered parent is not a directory.
*/
static int
fs_pdir(struct fs_softc *sc __unused, struct l9p_fid *fid, char *buf,
size_t size, struct stat *st)
{
struct fs_fid *ff;
char *path;
ff = fid->lo_aux;
assert(ff != NULL);
path = ff->ff_name;
path = r_dirname(path, buf, size);
if (path == NULL)
return (ENAMETOOLONG);
if (fstatat(ff->ff_dirfd, path, st, AT_SYMLINK_NOFOLLOW) != 0)
return (errno);
if (!S_ISDIR(st->st_mode))
return (ENOTDIR);
return (0);
}
/*
* Like fs_buildname() but for adding a file name to a buffer
* already holding a directory name. Essentially does
* strcat(dbuf, "/");
* strcat(dbuf, fname);
* but with size checking and an ENAMETOOLONG error as needed.
*
* (Think of the function name as "directory plus-equals file".)
*/
static int
fs_dpf(char *dbuf, char *fname, size_t size)
{
size_t dlen, nlen1;
dlen = strlen(dbuf);
nlen1 = strlen(fname) + 1;
if (dlen + 1 + nlen1 > size)
return (ENAMETOOLONG);
dbuf[dlen] = '/';
memcpy(dbuf + dlen + 1, fname, nlen1);
return (0);
}
/*
* Prepare to create a new directory entry (open with O_CREAT,
* mkdir, etc -- any operation that creates a new inode),
* operating in parent data <dir>, based on authinfo <ai> and
* effective gid <egid>.
*
* The new entity should be owned by user/group <*nuid, *ngid>,
* if it's really a new entity. It will be a directory if isdir.
*
* Returns an error number if the entry should not be created
* (e.g., read-only file system or no permission to write in
* parent directory). Always sets *nuid and *ngid on success:
* in the worst case, when there is no available ID, this will
* use the parent directory's IDs. Fills in <*st> on success.
*/
static int
fs_nde(struct fs_softc *sc, struct l9p_fid *dir, bool isdir, gid_t egid,
struct stat *st, uid_t *nuid, gid_t *ngid)
{
struct fs_fid *dirf;
struct fs_authinfo *ai;
int32_t op;
int error;
if (sc->fs_readonly)
return (EROFS);
dirf = dir->lo_aux;
assert(dirf != NULL);
if (fstatat(dirf->ff_dirfd, dirf->ff_name, st,
AT_SYMLINK_NOFOLLOW) != 0)
return (errno);
if (!S_ISDIR(st->st_mode))
return (ENOTDIR);
dirf = dir->lo_aux;
ai = dirf->ff_ai;
fillacl(dirf);
op = isdir ? L9P_ACE_ADD_SUBDIRECTORY : L9P_ACE_ADD_FILE;
error = check_access(op, dirf->ff_acl, st, NULL, NULL, ai, egid);
if (error)
return (EPERM);
*nuid = ai->ai_uid != (uid_t)-1 ? ai->ai_uid : st->st_uid;
*ngid = egid != (gid_t)-1 ? egid :
ai->ai_ngids > 0 ? ai->ai_gids[0] : st->st_gid;
return (0);
}
/*
* Allocate new open-file data structure to attach to a fid.
*
* The new file's authinfo is the same as the old one's, and
* we gain a reference.
*/
static struct fs_fid *
open_fid(int dirfd, const char *path, struct fs_authinfo *ai, bool creating)
{
struct fs_fid *ret;
uint32_t newcount;
int error;
ret = l9p_calloc(1, sizeof(*ret));
error = pthread_mutex_init(&ret->ff_mtx, NULL);
if (error) {
free(ret);
return (NULL);
}
ret->ff_fd = -1;
ret->ff_dirfd = dirfd;
ret->ff_name = strdup(path);
if (ret->ff_name == NULL) {
pthread_mutex_destroy(&ret->ff_mtx);
free(ret);
return (NULL);
}
pthread_mutex_lock(&ai->ai_mtx);
newcount = ++ai->ai_refcnt;
pthread_mutex_unlock(&ai->ai_mtx);
/*
* If we just incremented the count to 1, we're the *first*
* reference. This is only allowed when creating the authinfo,
* otherwise it means something has gone wrong. This cannot
* catch every bad (re)use of a freed authinfo but it may catch
* a few.
*/
assert(newcount > 1 || creating);
L9P_LOG(L9P_DEBUG, "authinfo %p now used by %lu",
(void *)ai, (u_long)newcount);
ret->ff_ai = ai;
return (ret);
}
static void
dostat(struct fs_softc *sc, struct l9p_stat *s, char *name,
struct stat *buf, bool dotu)
{
struct passwd *user;
struct group *group;
memset(s, 0, sizeof(struct l9p_stat));
generate_qid(buf, &s->qid);
s->type = 0;
s->dev = 0;
s->mode = buf->st_mode & 0777;
if (S_ISDIR(buf->st_mode))
s->mode |= L9P_DMDIR;
if (S_ISLNK(buf->st_mode) && dotu)
s->mode |= L9P_DMSYMLINK;
if (S_ISCHR(buf->st_mode) || S_ISBLK(buf->st_mode))
s->mode |= L9P_DMDEVICE;
if (S_ISSOCK(buf->st_mode))
s->mode |= L9P_DMSOCKET;
if (S_ISFIFO(buf->st_mode))
s->mode |= L9P_DMNAMEDPIPE;
s->atime = (uint32_t)buf->st_atime;
s->mtime = (uint32_t)buf->st_mtime;
s->length = (uint64_t)buf->st_size;
s->name = r_basename(name, NULL, 0);
if (!dotu) {
struct r_pgdata udata, gdata;
user = fs_getpwuid(sc, buf->st_uid, &udata);
group = fs_getgrgid(sc, buf->st_gid, &gdata);
s->uid = user != NULL ? strdup(user->pw_name) : NULL;
s->gid = group != NULL ? strdup(group->gr_name) : NULL;
s->muid = user != NULL ? strdup(user->pw_name) : NULL;
r_pgfree(&udata);
r_pgfree(&gdata);
} else {
/*
* When using 9P2000.u, we don't need to bother about
* providing user and group names in textual form.
*
* NB: if the asprintf()s fail, s->extension should
* be unset so we can ignore these.
*/
s->n_uid = buf->st_uid;
s->n_gid = buf->st_gid;
s->n_muid = buf->st_uid;
if (S_ISLNK(buf->st_mode)) {
char target[MAXPATHLEN];
ssize_t ret = readlink(name, target, MAXPATHLEN);
if (ret < 0) {
s->extension = NULL;
return;
}
s->extension = strndup(target, (size_t)ret);
}
if (S_ISBLK(buf->st_mode)) {
asprintf(&s->extension, "b %d %d", major(buf->st_rdev),
minor(buf->st_rdev));
}
if (S_ISCHR(buf->st_mode)) {
asprintf(&s->extension, "c %d %d", major(buf->st_rdev),
minor(buf->st_rdev));
}
}
}
static void dostatfs(struct l9p_statfs *out, struct statfs *in, long namelen)
{
out->type = L9P_FSTYPE;
out->bsize = in->f_bsize;
out->blocks = in->f_blocks;
out->bfree = in->f_bfree;
out->bavail = in->f_bavail;
out->files = in->f_files;
out->ffree = in->f_ffree;
out->namelen = (uint32_t)namelen;
out->fsid = ((uint64_t)in->f_fsid.val[0] << 32) |
(uint64_t)in->f_fsid.val[1];
}
static void
generate_qid(struct stat *buf, struct l9p_qid *qid)
{
qid->path = buf->st_ino;
qid->version = 0;
if (S_ISREG(buf->st_mode))
qid->type |= L9P_QTFILE;
if (S_ISDIR(buf->st_mode))
qid->type |= L9P_QTDIR;
if (S_ISLNK(buf->st_mode))
qid->type |= L9P_QTSYMLINK;
}
/*
* Fill in ff->ff_acl if it's not set yet. Skip if the "don't use
* ACLs" flag is set, and use the flag to remember failure so
* we don't bother retrying either.
*/
static void
fillacl(struct fs_fid *ff)
{
if (ff->ff_acl == NULL && (ff->ff_flags & FF_NO_NFSV4_ACL) == 0) {
ff->ff_acl = look_for_nfsv4_acl(ff, ff->ff_fd, ff->ff_name);
if (ff->ff_acl == NULL)
ff->ff_flags |= FF_NO_NFSV4_ACL;
}
}
/*
* Get an ACL given fd and/or path name. We check for the "don't get
* ACL" flag in the given ff_fid data structure first, but don't set
* the flag here. The fillacl() code is similar but will set the
* flag; it also uses the ff_fd and ff_name directly.
*
* (This is used to get ACLs for parent directories, for instance.)
*/
static struct l9p_acl *
getacl(struct fs_fid *ff, int fd, const char *path)
{
if (ff->ff_flags & FF_NO_NFSV4_ACL)
return (NULL);
return look_for_nfsv4_acl(ff, fd, path);
}
/*
* Drop cached ff->ff_acl, e.g., after moving from one directory to
* another, where inherited ACLs might change.
*/
static void
dropacl(struct fs_fid *ff)
{
l9p_acl_free(ff->ff_acl);
ff->ff_acl = NULL;
ff->ff_flags = ff->ff_ai->ai_flags;
}
/*
* Check to see if we can find NFSv4 ACLs for the given file.
* If we have an open fd, we can use that, otherwise we need
* to use the path.
*/
static struct l9p_acl *
look_for_nfsv4_acl(struct fs_fid *ff, int fd, const char *path)
{
struct l9p_acl *acl;
acl_t sysacl;
int doclose = 0;
if (fd < 0) {
fd = openat(ff->ff_dirfd, path, 0);
doclose = 1;
}
sysacl = acl_get_fd_np(fd, ACL_TYPE_NFS4);
if (sysacl == NULL) {
/*
* EINVAL means no NFSv4 ACLs apply for this file.
* Other error numbers indicate some kind of problem.
*/
if (errno != EINVAL) {
L9P_LOG(L9P_ERROR,
"error retrieving NFSv4 ACL from "
"fdesc %d (%s): %s", fd,
path, strerror(errno));
}
if (doclose)
close(fd);
return (NULL);
}
#if defined(HAVE_FREEBSD_ACLS)
acl = l9p_freebsd_nfsv4acl_to_acl(sysacl);
#else
acl = NULL; /* XXX need a l9p_darwin_acl_to_acl */
#endif
acl_free(sysacl);
if (doclose)
close(fd);
return (acl);
}
/*
* Verify that the user whose authinfo is in <ai> and effective
* group ID is <egid> ((gid_t)-1 means no egid supplied) has
* permission to do something.
*
* The "something" may be rather complex: we allow NFSv4 style
* operation masks here, and provide parent and child ACLs and
* stat data. At most one of pacl+pst and cacl+cst can be NULL,
* unless ACLs are not supported; then pacl and cacl can both
* be NULL but pst or cst must be non-NULL depending on the
* operation.
*/
static int
check_access(int32_t opmask,
struct l9p_acl *pacl, struct stat *pst,
struct l9p_acl *cacl, struct stat *cst,
struct fs_authinfo *ai, gid_t egid)
{
struct l9p_acl_check_args args;
/*
* If we have ACLs, use them exclusively, ignoring Unix
* permissions. Otherwise, fall back on stat st_mode
* bits, and allow super-user as well.
*/
args.aca_uid = ai->ai_uid;
args.aca_gid = egid;
args.aca_groups = ai->ai_gids;
args.aca_ngroups = (size_t)ai->ai_ngids;
args.aca_parent = pacl;
args.aca_pstat = pst;
args.aca_child = cacl;
args.aca_cstat = cst;
args.aca_aclmode = pacl == NULL && cacl == NULL
? L9P_ACM_STAT_MODE
: L9P_ACM_NFS_ACL | L9P_ACM_ZFS_ACL;
args.aca_superuser = true;
return (l9p_acl_check_access(opmask, &args));
}
static int
fs_attach(void *softc, struct l9p_request *req)
{
struct fs_authinfo *ai;
struct fs_softc *sc = (struct fs_softc *)softc;
struct fs_fid *file;
struct passwd *pwd;
struct stat st;
struct r_pgdata udata;
uint32_t n_uname;
gid_t *gids;
uid_t uid;
int error;
int ngroups;
assert(req->lr_fid != NULL);
/*
* Single-thread pwd/group related items. We have a reentrant
* r_getpwuid but not a reentrant r_getpwnam, and l9p_getgrlist
* may use non-reentrant C library getgr* routines.
*/
pthread_mutex_lock(&fs_attach_mutex);
n_uname = req->lr_req.tattach.n_uname;
if (n_uname != L9P_NONUNAME) {
uid = (uid_t)n_uname;
pwd = fs_getpwuid(sc, uid, &udata);
if (pwd == NULL)
L9P_LOG(L9P_DEBUG,
"Tattach: uid %ld: no such user", (long)uid);
} else {
uid = (uid_t)-1;
#if defined(WITH_CASPER)
pwd = cap_getpwnam(sc->fs_cappwd, req->lr_req.tattach.uname);
#else
pwd = getpwnam(req->lr_req.tattach.uname);
#endif
if (pwd == NULL)
L9P_LOG(L9P_DEBUG,
"Tattach: %s: no such user",
req->lr_req.tattach.uname);
}
/*
* If caller didn't give a numeric UID, pick it up from pwd
* if possible. If that doesn't work we can't continue.
*
* Note that pwd also supplies the group set. This assumes
* the server has the right mapping; this needs improvement.
* We do at least support ai->ai_ngids==0 properly now though.
*/
if (uid == (uid_t)-1 && pwd != NULL)
uid = pwd->pw_uid;
if (uid == (uid_t)-1)
error = EPERM;
else {
error = 0;
if (fstat(sc->fs_rootfd, &st) != 0)
error = errno;
else if (!S_ISDIR(st.st_mode))
error = ENOTDIR;
}
if (error) {
pthread_mutex_unlock(&fs_attach_mutex);
L9P_LOG(L9P_DEBUG,
"Tattach: denying uid=%ld access to rootdir: %s",
(long)uid, strerror(error));
/*
* Pass ENOENT and ENOTDIR through for diagnosis;
* others become EPERM. This should not leak too
* much security.
*/
return (error == ENOENT || error == ENOTDIR ? error : EPERM);
}
if (pwd != NULL) {
/*
* This either succeeds and fills in ngroups and
* returns non-NULL, or fails and sets ngroups to 0
* and returns NULL. Either way ngroups is correct.
*/
gids = l9p_getgrlist(pwd->pw_name, pwd->pw_gid, &ngroups);
} else {
gids = NULL;
ngroups = 0;
}
/*
* Done with pwd and group related items that may use
* non-reentrant C library routines; allow other threads in.
*/
pthread_mutex_unlock(&fs_attach_mutex);
ai = malloc(sizeof(*ai) + (size_t)ngroups * sizeof(gid_t));
if (ai == NULL) {
free(gids);
return (ENOMEM);
}
error = pthread_mutex_init(&ai->ai_mtx, NULL);
if (error) {
free(gids);
free(ai);
return (error);
}
ai->ai_refcnt = 0;
ai->ai_uid = uid;
ai->ai_flags = 0; /* XXX for now */
ai->ai_ngids = ngroups;
memcpy(ai->ai_gids, gids, (size_t)ngroups * sizeof(gid_t));
free(gids);
file = open_fid(sc->fs_rootfd, ".", ai, true);
if (file == NULL) {
pthread_mutex_destroy(&ai->ai_mtx);
free(ai);
return (ENOMEM);
}
req->lr_fid->lo_aux = file;
generate_qid(&st, &req->lr_resp.rattach.qid);
return (0);
}
static int
fs_clunk(void *softc __unused, struct l9p_fid *fid)
{
struct fs_fid *file;
file = fid->lo_aux;
assert(file != NULL);
if (file->ff_dir) {
closedir(file->ff_dir);
file->ff_dir = NULL;
} else if (file->ff_fd != -1) {
close(file->ff_fd);
file->ff_fd = -1;
}
return (0);
}
/*
* Create ops.
*
* We are to create a new file under some existing path,
* where the new file's name is in the Tcreate request and the
* existing path is due to a fid-based file (req->lr_fid).
*
* One op (create regular file) sets file->fd, the rest do not.
*/
static int
fs_create(void *softc, struct l9p_request *req)
{
struct l9p_fid *dir;
struct stat st;
uint32_t dmperm;
mode_t perm;
char *name;
int error;
dir = req->lr_fid;
name = req->lr_req.tcreate.name;
dmperm = req->lr_req.tcreate.perm;
perm = (mode_t)(dmperm & 0777);
if (dmperm & L9P_DMDIR)
error = fs_imkdir(softc, dir, name, true,
perm, (gid_t)-1, &st);
else if (dmperm & L9P_DMSYMLINK)
error = fs_isymlink(softc, dir, name,
req->lr_req.tcreate.extension, (gid_t)-1, &st);
else if (dmperm & L9P_DMNAMEDPIPE)
error = fs_imkfifo(softc, dir, name, true,
perm, (gid_t)-1, &st);
else if (dmperm & L9P_DMSOCKET)
error = fs_imksocket(softc, dir, name, true,
perm, (gid_t)-1, &st);
else if (dmperm & L9P_DMDEVICE) {
unsigned int major, minor;
char type;
dev_t dev;
/*
* ??? Should this be testing < 3? For now, allow a single
* integer mode with minor==0 implied.
*/
minor = 0;
if (sscanf(req->lr_req.tcreate.extension, "%c %u %u",
&type, &major, &minor) < 2) {
return (EINVAL);
}
switch (type) {
case 'b':
perm |= S_IFBLK;
break;
case 'c':
perm |= S_IFCHR;
break;
default:
return (EINVAL);
}
dev = makedev(major, minor);
error = fs_imknod(softc, dir, name, true, perm, dev,
(gid_t)-1, &st);
} else {
enum l9p_omode p9;
int flags;
p9 = req->lr_req.tcreate.mode;
error = fs_oflags_dotu(p9, &flags);
if (error)
return (error);
error = fs_icreate(softc, dir, name, flags,
true, perm, (gid_t)-1, &st);
req->lr_resp.rcreate.iounit = req->lr_conn->lc_max_io_size;
}
if (error == 0)
generate_qid(&st, &req->lr_resp.rcreate.qid);
return (error);
}
/*
* https://swtch.com/plan9port/man/man9/open.html and
* http://plan9.bell-labs.com/magic/man2html/5/open
* say that permissions are actually
* perm & (~0666 | (dir.perm & 0666))
* for files, and
* perm & (~0777 | (dir.perm & 0777))
* for directories. That is, the parent directory may
* take away permissions granted by the operation.
*
* This seems a bit restrictive; probably
* there should be a control knob for this.
*/
static inline mode_t
fs_p9perm(mode_t perm, mode_t dir_perm, bool isdir)
{
if (isdir)
perm &= ~0777 | (dir_perm & 0777);
else
perm &= ~0666 | (dir_perm & 0666);
return (perm);
}
/*
* Internal form of create (plain file).
*
* Our caller takes care of splitting off all the special
* types of create (mknod, etc), so this is purely for files.
* We receive the fs_softc <softc>, the directory fid <dir>
* in which the new file is to be created, the name of the
* new file, a flag <isp9> indicating whether to do plan9 style
* permissions or Linux style permissions, the permissions <perm>,
* an effective group id <egid>, and a pointer to a stat structure
* <st> to fill in describing the final result on success.
*
* On successful create, the fid switches to the newly created
* file, which is now open; its associated file-name changes too.
*
* Note that the original (dir) fid is never currently open,
* so there is nothing to close.
*/
static int
fs_icreate(void *softc, struct l9p_fid *dir, char *name, int flags,
bool isp9, mode_t perm, gid_t egid, struct stat *st)
{
struct fs_fid *file;
gid_t gid;
uid_t uid;
char newname[MAXPATHLEN];
int error, fd;
file = dir->lo_aux;
/*
* Build full path name from directory + file name. We'll
* check permissions on the parent directory, then race to
* create the file before anything bad happens like symlinks.
*
* (To close this race we need to use openat(), which is
* left for a later version of this code.)
*/
error = fs_buildname(dir, name, newname, sizeof(newname));
if (error)
return (error);
/* In case of success, we will need a new file->ff_name. */
name = strdup(newname);
if (name == NULL)
return (ENOMEM);
/* Check create permission and compute new file ownership. */
error = fs_nde(softc, dir, false, egid, st, &uid, &gid);
if (error) {
free(name);
return (error);
}
/* Adjust new-file permissions for Plan9 protocol. */
if (isp9)
perm = fs_p9perm(perm, st->st_mode, false);
/* Create is always exclusive so O_TRUNC is irrelevant. */
fd = openat(file->ff_dirfd, newname, flags | O_CREAT | O_EXCL, perm);
if (fd < 0) {
error = errno;
free(name);
return (error);
}
/* Fix permissions and owner. */
if (fchmod(fd, perm) != 0 ||
fchown(fd, uid, gid) != 0 ||
fstat(fd, st) != 0) {
error = errno;
(void) close(fd);
/* unlink(newname); ? */
free(name);
return (error);
}
/* It *was* a directory; now it's a file, and it's open. */
free(file->ff_name);
file->ff_name = name;
file->ff_fd = fd;
return (0);
}
/*
* Internal form of open: stat file and verify permissions (from p9
* argument), then open the file-or-directory, leaving the internal
* fs_fid fields set up. If we cannot open the file, return a
* suitable error number, and leave everything unchanged.
*
* To mitigate the race between permissions testing and the actual
* open, we can stat the file twice (once with lstat() before open,
* then with fstat() after). We assume O_NOFOLLOW is set in flags,
* so if some other race-winner substitutes in a symlink we won't
* open it here. (However, embedded symlinks, if they occur, are
* still an issue. Ideally we would like to have an O_NEVERFOLLOW
* that fails on embedded symlinks, and a way to pass this to
* lstat() as well.)
*
* When we use opendir() we cannot pass O_NOFOLLOW, so we must rely
* on substitution-detection via fstat(). To simplify the code we
* just always re-check.
*
* (For a proper fix in the future, we can require openat(), keep
* each parent directory open during walk etc, and allow only final
* name components with O_NOFOLLOW.)
*
* On successful return, st has been filled in.
*/
static int
fs_iopen(void *softc, struct l9p_fid *fid, int flags, enum l9p_omode p9,
gid_t egid __unused, struct stat *st)
{
struct fs_softc *sc = softc;
struct fs_fid *file;
struct stat first;
int32_t op;
char *name;
int error;
int fd;
DIR *dirp;
/* Forbid write ops on read-only file system. */
if (sc->fs_readonly) {
if ((flags & O_TRUNC) != 0)
return (EROFS);
if ((flags & O_ACCMODE) != O_RDONLY)
return (EROFS);
if (p9 & L9P_ORCLOSE)
return (EROFS);
}
file = fid->lo_aux;
assert(file != NULL);
name = file->ff_name;
if (fstatat(file->ff_dirfd, name, &first, AT_SYMLINK_NOFOLLOW) != 0)
return (errno);
if (S_ISLNK(first.st_mode))
return (EPERM);
/* Can we rely on O_APPEND here? Best not, can be cleared. */
switch (flags & O_ACCMODE) {
case O_RDONLY:
op = L9P_ACE_READ_DATA;
break;
case O_WRONLY:
op = L9P_ACE_WRITE_DATA;
break;
case O_RDWR:
op = L9P_ACE_READ_DATA | L9P_ACE_WRITE_DATA;
break;
default:
return (EINVAL);
}
fillacl(file);
error = check_access(op, NULL, NULL, file->ff_acl, &first,
file->ff_ai, (gid_t)-1);
if (error)
return (error);
if (S_ISDIR(first.st_mode)) {
/* Forbid write or truncate on directory. */
if ((flags & O_ACCMODE) != O_RDONLY || (flags & O_TRUNC))
return (EPERM);
fd = openat(file->ff_dirfd, name, O_DIRECTORY);
dirp = fdopendir(fd);
if (dirp == NULL)
return (EPERM);
fd = dirfd(dirp);
} else {
dirp = NULL;
fd = openat(file->ff_dirfd, name, flags);
if (fd < 0)
return (EPERM);
}
/*
* We have a valid fd, and maybe non-null dirp. Re-check
* the file, and fail if st_dev or st_ino changed.
*/
if (fstat(fd, st) != 0 ||
first.st_dev != st->st_dev ||
first.st_ino != st->st_ino) {
if (dirp != NULL)
(void) closedir(dirp);
else
(void) close(fd);
return (EPERM);
}
if (dirp != NULL)
file->ff_dir = dirp;
else
file->ff_fd = fd;
return (0);
}
/*
* Internal form of mkdir (common code for all forms).
* We receive the fs_softc <softc>, the directory fid <dir>
* in which the new entry is to be created, the name of the
* new entry, a flag <isp9> indicating whether to do plan9 style
* permissions or Linux style permissions, the permissions <perm>,
* an effective group id <egid>, and a pointer to a stat structure
* <st> to fill in describing the final result on success.
*
* See also fs_icreate() above.
*/
static int
fs_imkdir(void *softc, struct l9p_fid *dir, char *name,
bool isp9, mode_t perm, gid_t egid, struct stat *st)
{
struct fs_fid *ff;
gid_t gid;
uid_t uid;
char newname[MAXPATHLEN];
int error, fd;
ff = dir->lo_aux;
error = fs_buildname(dir, name, newname, sizeof(newname));
if (error)
return (error);
error = fs_nde(softc, dir, true, egid, st, &uid, &gid);
if (error)
return (error);
if (isp9)
perm = fs_p9perm(perm, st->st_mode, true);
if (mkdirat(ff->ff_dirfd, newname, perm) != 0)
return (errno);
fd = openat(ff->ff_dirfd, newname,
O_DIRECTORY | O_RDONLY | O_NOFOLLOW);
if (fd < 0 ||
fchown(fd, uid, gid) != 0 ||
fchmod(fd, perm) != 0 ||
fstat(fd, st) != 0) {
error = errno;
/* rmdir(newname) ? */
}
if (fd >= 0)
(void) close(fd);
return (error);
}
#ifdef __APPLE__
/*
* This is an undocumented OS X syscall. It would be best to avoid it,
* but there doesn't seem to be another safe way to implement mknodat.
* Dear Apple, please implement mknodat before you remove this syscall.
*/
static int fs_ifchdir_thread_local(int fd)
{
#pragma clang diagnostic push
#pragma clang diagnostic ignored "-Wdeprecated-declarations"
return syscall(SYS___pthread_fchdir, fd);
#pragma clang diagnostic pop
}
#endif
/*
* Internal form of mknod (special device).
*
* The device type (S_IFBLK, S_IFCHR) is included in the <mode> parameter.
*/
static int
fs_imknod(void *softc, struct l9p_fid *dir, char *name,
bool isp9, mode_t mode, dev_t dev, gid_t egid, struct stat *st)
{
struct fs_fid *ff;
mode_t perm;
gid_t gid;
uid_t uid;
char newname[MAXPATHLEN];
int error;
ff = dir->lo_aux;
error = fs_buildname(dir, name, newname, sizeof(newname));
if (error)
return (error);
error = fs_nde(softc, dir, false, egid, st, &uid, &gid);
if (error)
return (error);
if (isp9) {
perm = fs_p9perm(mode & 0777, st->st_mode, false);
mode = (mode & ~0777) | perm;
} else {
perm = mode & 0777;
}
#ifdef __APPLE__
if (fs_ifchdir_thread_local(ff->ff_dirfd) < 0) {
return -1;
}
error = mknod(newname, mode, dev);
int preserved_errno = errno;
/* Stop using the thread-local cwd */
fs_ifchdir_thread_local(-1);
if (error < 0) {
errno = preserved_errno;
return errno;
}
#else
if (mknodat(ff->ff_dirfd, newname, mode, dev) != 0)
return (errno);
#endif
/* We cannot open the new name; race to use l* syscalls. */
if (fchownat(ff->ff_dirfd, newname, uid, gid, AT_SYMLINK_NOFOLLOW) != 0 ||
fchmodat(ff->ff_dirfd, newname, perm, AT_SYMLINK_NOFOLLOW) != 0 ||
fstatat(ff->ff_dirfd, newname, st, AT_SYMLINK_NOFOLLOW) != 0)
error = errno;
else if ((st->st_mode & S_IFMT) != (mode & S_IFMT))
error = EPERM; /* ??? lost a race anyway */
/* if (error) unlink(newname) ? */
return (error);
}
/*
* Internal form of mkfifo.
*/
static int
fs_imkfifo(void *softc, struct l9p_fid *dir, char *name,
bool isp9, mode_t perm, gid_t egid, struct stat *st)
{
struct fs_fid *ff;
gid_t gid;
uid_t uid;
char newname[MAXPATHLEN];
int error;
ff = dir->lo_aux;
error = fs_buildname(dir, name, newname, sizeof(newname));
if (error)
return (error);
error = fs_nde(softc, dir, false, egid, st, &uid, &gid);
if (error)
return (error);
if (isp9)
perm = fs_p9perm(perm, st->st_mode, false);
if (mkfifo(newname, perm) != 0)
return (errno);
/* We cannot open the new name; race to use l* syscalls. */
if (fchownat(ff->ff_dirfd, newname, uid, gid, AT_SYMLINK_NOFOLLOW) != 0 ||
fchmodat(ff->ff_dirfd, newname, perm, AT_SYMLINK_NOFOLLOW) != 0 ||
fstatat(ff->ff_dirfd, newname, st, AT_SYMLINK_NOFOLLOW) != 0)
error = errno;
else if (!S_ISFIFO(st->st_mode))
error = EPERM; /* ??? lost a race anyway */
/* if (error) unlink(newname) ? */
return (error);
}
/*
* Internal form of mksocket.
*
* This is a bit different because of the horrible socket naming
* system (bind() with sockaddr_un sun_path).
*/
static int
fs_imksocket(void *softc, struct l9p_fid *dir, char *name,
bool isp9, mode_t perm, gid_t egid, struct stat *st)
{
struct fs_fid *ff;
struct sockaddr_un sun;
char *path;
char newname[MAXPATHLEN];
gid_t gid;
uid_t uid;
int error = 0, s, fd;
ff = dir->lo_aux;
error = fs_buildname(dir, name, newname, sizeof(newname));
if (error)
return (error);
error = fs_nde(softc, dir, false, egid, st, &uid, &gid);
if (error)
return (error);
if (isp9)
perm = fs_p9perm(perm, st->st_mode, false);
s = socket(AF_UNIX, SOCK_STREAM, 0);
if (s < 0)
return (errno);
path = newname;
fd = -1;
#ifdef HAVE_BINDAT
/* Try bindat() if needed. */
if (strlen(path) >= sizeof(sun.sun_path)) {
fd = openat(ff->ff_dirfd, ff->ff_name,
O_RDONLY | O_DIRECTORY | O_NOFOLLOW);
if (fd >= 0)
path = name;
}
#endif
/*
* Can only create the socket if the path will fit.
* Even if we are using bindat() there are limits
* (the API for AF_UNIX sockets is ... not good).
*
* Note: in theory we can fill sun_path to the end
* (omitting a terminating '\0') but in at least one
* Unix-like system, this was known to behave oddly,
* so we test for ">=" rather than just ">".
*/
if (strlen(path) >= sizeof(sun.sun_path)) {
error = ENAMETOOLONG;
goto out;
}
sun.sun_family = AF_UNIX;
sun.sun_len = sizeof(struct sockaddr_un);
strncpy(sun.sun_path, path, sizeof(sun.sun_path));
#ifdef HAVE_BINDAT
if (fd >= 0) {
if (bindat(fd, s, (struct sockaddr *)&sun, sun.sun_len) < 0)
error = errno;
goto out; /* done now, for good or ill */
}
#endif
if (bind(s, (struct sockaddr *)&sun, sun.sun_len) < 0)
error = errno;
out:
if (error == 0) {
/*
* We believe we created the socket-inode. Fix
* permissions etc. Note that we cannot use
* fstat() on the socket descriptor: it succeeds,
* but we get bogus data!
*/
if (fchownat(ff->ff_dirfd, newname, uid, gid, AT_SYMLINK_NOFOLLOW) != 0 ||
fchmodat(ff->ff_dirfd, newname, perm, AT_SYMLINK_NOFOLLOW) != 0 ||
fstatat(ff->ff_dirfd, newname, st, AT_SYMLINK_NOFOLLOW) != 0)
error = errno;
else if (!S_ISSOCK(st->st_mode))
error = EPERM; /* ??? lost a race anyway */
/* if (error) unlink(newname) ? */
}
/*
* It's not clear which error should override, although
* ideally we should never see either close() call fail.
* In any case we do want to try to close both fd and s,
* always. Let's set error only if it is not already set,
* so that all exit paths can use the same code.
*/
if (fd >= 0 && close(fd) != 0)
if (error == 0)
error = errno;
if (close(s) != 0)
if (error == 0)
error = errno;
return (error);
}
/*
* Internal form of symlink.
*
* Note that symlinks are presumed to carry no permission bits.
* They do have owners, however (who may be charged for quotas).
*/
static int
fs_isymlink(void *softc, struct l9p_fid *dir, char *name,
char *symtgt, gid_t egid, struct stat *st)
{
struct fs_fid *ff;
gid_t gid;
uid_t uid;
char newname[MAXPATHLEN];
int error;
ff = dir->lo_aux;
error = fs_buildname(dir, name, newname, sizeof(newname));
if (error)
return (error);
error = fs_nde(softc, dir, false, egid, st, &uid, &gid);
if (error)
return (error);
if (symlinkat(symtgt, ff->ff_dirfd, newname) != 0)
return (errno);
/* We cannot open the new name; race to use l* syscalls. */
if (fchownat(ff->ff_dirfd, newname, uid, gid, AT_SYMLINK_NOFOLLOW) != 0 ||
fstatat(ff->ff_dirfd, newname, st, AT_SYMLINK_NOFOLLOW) != 0)
error = errno;
else if (!S_ISLNK(st->st_mode))
error = EPERM; /* ??? lost a race anyway */
/* if (error) unlink(newname) ? */
return (error);
}
static int
fs_open(void *softc, struct l9p_request *req)
{
struct l9p_fid *fid = req->lr_fid;
struct stat st;
enum l9p_omode p9;
int error, flags;
p9 = req->lr_req.topen.mode;
error = fs_oflags_dotu(p9, &flags);
if (error)
return (error);
error = fs_iopen(softc, fid, flags, p9, (gid_t)-1, &st);
if (error)
return (error);
generate_qid(&st, &req->lr_resp.ropen.qid);
req->lr_resp.ropen.iounit = req->lr_conn->lc_max_io_size;
return (0);
}
/*
* Helper for directory read. We want to run an lstat on each
* file name within the directory. This is a lot faster if we
* have lstatat (or fstatat with AT_SYMLINK_NOFOLLOW), but not
* all systems do, so hide the ifdef-ed code in an inline function.
*/
static inline int
fs_lstatat(struct fs_fid *file, char *name, struct stat *st)
{
return (fstatat(dirfd(file->ff_dir), name, st, AT_SYMLINK_NOFOLLOW));
}
static int
fs_read(void *softc, struct l9p_request *req)
{
struct l9p_stat l9stat;
struct fs_softc *sc;
struct fs_fid *file;
bool dotu = req->lr_conn->lc_version >= L9P_2000U;
ssize_t ret;
sc = softc;
file = req->lr_fid->lo_aux;
assert(file != NULL);
if (file->ff_dir != NULL) {
struct dirent *d;
struct stat st;
struct l9p_message msg;
long o;
pthread_mutex_lock(&file->ff_mtx);
/*
* Must use telldir before readdir since seekdir
* takes cookie values. Unfortunately this wastes
* a lot of time (and memory) building unneeded
* cookies that can only be flushed by closing
* the directory.
*
* NB: FreeBSD libc seekdir has SINGLEUSE defined,
* so in fact, we can discard the cookies by
* calling seekdir on them. This clears up wasted
* memory at the cost of even more wasted time...
*
* XXX: readdir/telldir/seekdir not thread safe
*/
l9p_init_msg(&msg, req, L9P_PACK);
for (;;) {
o = telldir(file->ff_dir);
d = readdir(file->ff_dir);
if (d == NULL)
break;
if (fs_lstatat(file, d->d_name, &st))
continue;
dostat(sc, &l9stat, d->d_name, &st, dotu);
if (l9p_pack_stat(&msg, req, &l9stat) != 0) {
seekdir(file->ff_dir, o);
break;
}
#if defined(__FreeBSD__)
seekdir(file->ff_dir, o);
(void) readdir(file->ff_dir);
#endif
}
pthread_mutex_unlock(&file->ff_mtx);
} else {
size_t niov = l9p_truncate_iov(req->lr_data_iov,
req->lr_data_niov, req->lr_req.io.count);
#if defined(__FreeBSD__)
ret = preadv(file->ff_fd, req->lr_data_iov, niov,
req->lr_req.io.offset);
#else
/* XXX: not thread safe, should really use aio_listio. */
if (lseek(file->ff_fd, (off_t)req->lr_req.io.offset, SEEK_SET) < 0)
return (errno);
ret = (uint32_t)readv(file->ff_fd, req->lr_data_iov, (int)niov);
#endif
if (ret < 0)
return (errno);
req->lr_resp.io.count = (uint32_t)ret;
}
return (0);
}
static int
fs_remove(void *softc, struct l9p_fid *fid)
{
struct fs_softc *sc = softc;
struct l9p_acl *parent_acl;
struct fs_fid *file;
struct stat pst, cst;
char dirname[MAXPATHLEN];
int error;
if (sc->fs_readonly)
return (EROFS);
error = fs_pdir(sc, fid, dirname, sizeof(dirname), &pst);
if (error)
return (error);
file = fid->lo_aux;
if (fstatat(file->ff_dirfd, file->ff_name, &cst, AT_SYMLINK_NOFOLLOW) != 0)
return (error);
parent_acl = getacl(file, -1, dirname);
fillacl(file);
error = check_access(L9P_ACOP_UNLINK,
parent_acl, &pst, file->ff_acl, &cst, file->ff_ai, (gid_t)-1);
l9p_acl_free(parent_acl);
if (error)
return (error);
if (unlinkat(file->ff_dirfd, file->ff_name,
S_ISDIR(cst.st_mode) ? AT_REMOVEDIR : 0) != 0)
error = errno;
return (error);
}
static int
fs_stat(void *softc, struct l9p_request *req)
{
struct fs_softc *sc;
struct fs_fid *file;
struct stat st;
bool dotu = req->lr_conn->lc_version >= L9P_2000U;
sc = softc;
file = req->lr_fid->lo_aux;
assert(file);
if (fstatat(file->ff_dirfd, file->ff_name, &st,
AT_SYMLINK_NOFOLLOW) != 0)
return (errno);
dostat(sc, &req->lr_resp.rstat.stat, file->ff_name, &st, dotu);
return (0);
}
static int
fs_walk(void *softc, struct l9p_request *req)
{
struct l9p_acl *acl;
struct fs_authinfo *ai;
struct fs_fid *file = req->lr_fid->lo_aux;
struct fs_fid *newfile;
struct stat st;
size_t clen, namelen, need;
char *comp, *succ, *next, *swtmp;
bool atroot;
bool dotdot;
int i, nwname;
int error = 0;
char namebufs[2][MAXPATHLEN];
/*
* https://swtch.com/plan9port/man/man9/walk.html:
*
* It is legal for nwname to be zero, in which case newfid
* will represent the same file as fid and the walk will
* usually succeed; this is equivalent to walking to dot.
* [Aside: it's not clear if we should test S_ISDIR here.]
* ...
* The name ".." ... represents the parent directory.
* The name "." ... is not used in the protocol.
* ... A walk of the name ".." in the root directory
* of the server is equivalent to a walk with no name
* elements.
*
* Note that req.twalk.nwname never exceeds L9P_MAX_WELEM,
* so it is safe to convert to plain int.
*
* We are to return an error only if the first walk fails,
* else stop at the end of the names or on the first error.
* The final fid is based on the last name successfully
* walked.
*
* Note that we *do* get Twalk requests with nwname==0 on files.
*
* Set up "successful name" buffer pointer with base fid name,
* initially. We'll swap each new success into it as we go.
*
* Invariant: atroot and stat data correspond to current
* (succ) path.
*/
succ = namebufs[0];
next = namebufs[1];
namelen = strlcpy(succ, file->ff_name, MAXPATHLEN);
if (namelen >= MAXPATHLEN)
return (ENAMETOOLONG);
if (fstatat(file->ff_dirfd, succ, &st, AT_SYMLINK_NOFOLLOW) < 0)
return (errno);
ai = file->ff_ai;
atroot = strlen(succ) == 0; /* XXX? */
fillacl(file);
acl = file->ff_acl;
nwname = (int)req->lr_req.twalk.nwname;
for (i = 0; i < nwname; i++) {
/*
* Must have execute permission to search a directory.
* Then, look up each component in its directory-so-far.
* Check for ".." along the way, handlng specially
* as needed. Forbid "/" in name components.
*
*/
if (!S_ISDIR(st.st_mode)) {
error = ENOTDIR;
goto out;
}
error = check_access(L9P_ACE_EXECUTE,
NULL, NULL, acl, &st, ai, (gid_t)-1);
if (error) {
L9P_LOG(L9P_DEBUG,
"Twalk: denying dir-walk on \"%s\" for uid %u",
succ, (unsigned)ai->ai_uid);
error = EPERM;
goto out;
}
comp = req->lr_req.twalk.wname[i];
if (strchr(comp, '/') != NULL) {
error = EINVAL;
break;
}
clen = strlen(comp);
dotdot = false;
/*
* Build next pathname (into "next"). If "..",
* just strip one name component off the success
* name so far. Since we know this name fits, the
* stripped down version also fits. Otherwise,
* the name is the base name plus '/' plus the
* component name plus terminating '\0'; this may
* or may not fit.
*/
if (comp[0] == '.') {
if (clen == 1) {
error = EINVAL;
break;
}
if (comp[1] == '.' && clen == 2)
dotdot = true;
}
if (dotdot) {
/*
* It's not clear how ".." at root should
* be handled when i > 0. Obeying the man
* page exactly, we reset i to 0 and stop,
* declaring terminal success.
*
* Otherwise, we just climbed up one level
* so adjust "atroot".
*/
if (atroot) {
i = 0;
break;
}
(void) r_dirname(succ, next, MAXPATHLEN);
namelen = strlen(next);
atroot = strlen(next) == 0; /* XXX? */
} else {
need = namelen + 1 + clen + 1;
if (need > MAXPATHLEN) {
error = ENAMETOOLONG;
break;
}
memcpy(next, succ, namelen);
next[namelen++] = '/';
memcpy(&next[namelen], comp, clen + 1);
namelen += clen;
/*
* Since name is never ".", we are necessarily
* descending below the root now.
*/
atroot = false;
}
if (fstatat(file->ff_dirfd, next, &st, AT_SYMLINK_NOFOLLOW) < 0) {
error = ENOENT;
break;
}
/*
* Success: generate qid and swap this
* successful name into place. Update acl.
*/
generate_qid(&st, &req->lr_resp.rwalk.wqid[i]);
swtmp = succ;
succ = next;
next = swtmp;
if (acl != NULL && acl != file->ff_acl)
l9p_acl_free(acl);
acl = getacl(file, -1, next);
}
/*
* Fail only if we failed on the first name.
* Otherwise we succeeded on something, and "succ"
* points to the last successful name in namebufs[].
*/
if (error) {
if (i == 0)
goto out;
error = 0;
}
newfile = open_fid(file->ff_dirfd, succ, ai, false);
if (newfile == NULL) {
error = ENOMEM;
goto out;
}
if (req->lr_newfid == req->lr_fid) {
/*
* Before overwriting fid->lo_aux, free the old value.
* Note that this doesn't free the l9p_fid data,
* just the fs_fid data. (But it does ditch ff_acl.)
*/
if (acl == file->ff_acl)
acl = NULL;
fs_freefid(softc, req->lr_fid);
file = NULL;
}
req->lr_newfid->lo_aux = newfile;
if (file != NULL && acl != file->ff_acl) {
newfile->ff_acl = acl;
acl = NULL;
}
req->lr_resp.rwalk.nwqid = (uint16_t)i;
out:
if (file != NULL && acl != file->ff_acl)
l9p_acl_free(acl);
return (error);
}
static int
fs_write(void *softc, struct l9p_request *req)
{
struct fs_softc *sc = softc;
struct fs_fid *file;
ssize_t ret;
file = req->lr_fid->lo_aux;
assert(file != NULL);
if (sc->fs_readonly)
return (EROFS);
size_t niov = l9p_truncate_iov(req->lr_data_iov,
req->lr_data_niov, req->lr_req.io.count);
#if defined(__FreeBSD__)
ret = pwritev(file->ff_fd, req->lr_data_iov, niov,
req->lr_req.io.offset);
#else
/* XXX: not thread safe, should really use aio_listio. */
if (lseek(file->ff_fd, (off_t)req->lr_req.io.offset, SEEK_SET) < 0)
return (errno);
ret = writev(file->ff_fd, req->lr_data_iov,
(int)niov);
#endif
if (ret < 0)
return (errno);
req->lr_resp.io.count = (uint32_t)ret;
return (0);
}
static int
fs_wstat(void *softc, struct l9p_request *req)
{
struct fs_softc *sc = softc;
struct l9p_stat *l9stat = &req->lr_req.twstat.stat;
struct l9p_fid *fid;
struct fs_fid *file;
int error = 0;
fid = req->lr_fid;
file = fid->lo_aux;
assert(file != NULL);
/*
* XXX:
*
* stat(9P) sez:
*
* Either all the changes in wstat request happen, or none of them
* does: if the request succeeds, all changes were made; if it fails,
* none were.
*
* Atomicity is clearly missing in current implementation.
*/
if (sc->fs_readonly)
return (EROFS);
if (l9stat->atime != (uint32_t)~0) {
/* XXX: not implemented, ignore */
}
if (l9stat->mtime != (uint32_t)~0) {
/* XXX: not implemented, ignore */
}
if (l9stat->dev != (uint32_t)~0) {
error = EPERM;
goto out;
}
if (l9stat->length != (uint64_t)~0) {
if (file->ff_dir != NULL) {
error = EINVAL;
goto out;
}
if (truncate(file->ff_name, (off_t)l9stat->length) != 0) {
error = errno;
goto out;
}
}
if (req->lr_conn->lc_version >= L9P_2000U) {
if (fchownat(file->ff_dirfd, file->ff_name, l9stat->n_uid,
l9stat->n_gid, AT_SYMLINK_NOFOLLOW) != 0) {
error = errno;
goto out;
}
}
if (l9stat->mode != (uint32_t)~0) {
if (fchmodat(file->ff_dirfd, file->ff_name,
l9stat->mode & 0777, 0) != 0) {
error = errno;
goto out;
}
}
if (strlen(l9stat->name) > 0) {
struct l9p_acl *parent_acl;
struct stat st;
char *tmp;
char newname[MAXPATHLEN];
/*
* Rename-within-directory: it's not deleting anything,
* but we need write permission on the directory. This
* should suffice.
*/
error = fs_pdir(softc, fid, newname, sizeof(newname), &st);
if (error)
goto out;
parent_acl = getacl(file, -1, newname);
error = check_access(L9P_ACE_ADD_FILE,
parent_acl, &st, NULL, NULL, file->ff_ai, (gid_t)-1);
l9p_acl_free(parent_acl);
if (error)
goto out;
error = fs_dpf(newname, l9stat->name, sizeof(newname));
if (error)
goto out;
tmp = strdup(newname);
if (tmp == NULL) {
error = ENOMEM;
goto out;
}
if (renameat(file->ff_dirfd, file->ff_name, file->ff_dirfd,
tmp) != 0) {
error = errno;
free(tmp);
goto out;
}
/* Successful rename, update file->ff_name. ACL can stay. */
free(file->ff_name);
file->ff_name = tmp;
}
out:
return (error);
}
static int
fs_statfs(void *softc __unused, struct l9p_request *req)
{
struct fs_fid *file;
struct stat st;
struct statfs f;
long name_max;
int error;
int fd;
file = req->lr_fid->lo_aux;
assert(file);
if (fstatat(file->ff_dirfd, file->ff_name, &st,
AT_SYMLINK_NOFOLLOW) != 0)
return (errno);
/*
* Not entirely clear what access to require; we'll go
* for "read data".
*/
fillacl(file);
error = check_access(L9P_ACE_READ_DATA, NULL, NULL,
file->ff_acl, &st, file->ff_ai, (gid_t)-1);
if (error)
return (error);
fd = openat(file->ff_dirfd, file->ff_name, 0);
if (fd < 0)
return (errno);
if (fstatfs(fd, &f) != 0)
return (errno);
name_max = fpathconf(fd, _PC_NAME_MAX);
error = errno;
close(fd);
if (name_max == -1)
return (error);
dostatfs(&req->lr_resp.rstatfs.statfs, &f, name_max);
return (0);
}
static int
fs_lopen(void *softc, struct l9p_request *req)
{
struct l9p_fid *fid = req->lr_fid;
struct stat st;
enum l9p_omode p9;
gid_t gid;
int error, flags;
error = fs_oflags_dotl(req->lr_req.tlopen.flags, &flags, &p9);
if (error)
return (error);
gid = req->lr_req.tlopen.gid;
error = fs_iopen(softc, fid, flags, p9, gid, &st);
if (error)
return (error);
generate_qid(&st, &req->lr_resp.rlopen.qid);
req->lr_resp.rlopen.iounit = req->lr_conn->lc_max_io_size;
return (0);
}
static int
fs_lcreate(void *softc, struct l9p_request *req)
{
struct l9p_fid *dir;
struct stat st;
enum l9p_omode p9;
char *name;
mode_t perm;
gid_t gid;
int error, flags;
dir = req->lr_fid;
name = req->lr_req.tlcreate.name;
error = fs_oflags_dotl(req->lr_req.tlcreate.flags, &flags, &p9);
if (error)
return (error);
perm = (mode_t)req->lr_req.tlcreate.mode & 0777; /* ? set-id bits? */
gid = req->lr_req.tlcreate.gid;
error = fs_icreate(softc, dir, name, flags, false, perm, gid, &st);
if (error == 0)
generate_qid(&st, &req->lr_resp.rlcreate.qid);
req->lr_resp.rlcreate.iounit = req->lr_conn->lc_max_io_size;
return (error);
}
static int
fs_symlink(void *softc, struct l9p_request *req)
{
struct l9p_fid *dir;
struct stat st;
gid_t gid;
char *name, *symtgt;
int error;
dir = req->lr_fid;
name = req->lr_req.tsymlink.name;
symtgt = req->lr_req.tsymlink.symtgt;
gid = req->lr_req.tsymlink.gid;
error = fs_isymlink(softc, dir, name, symtgt, gid, &st);
if (error == 0)
generate_qid(&st, &req->lr_resp.rsymlink.qid);
return (error);
}
static int
fs_mknod(void *softc, struct l9p_request *req)
{
struct l9p_fid *dir;
struct stat st;
uint32_t mode, major, minor;
dev_t dev;
gid_t gid;
char *name;
int error;
dir = req->lr_fid;
name = req->lr_req.tmknod.name;
mode = req->lr_req.tmknod.mode;
gid = req->lr_req.tmknod.gid;
switch (mode & S_IFMT) {
case S_IFBLK:
case S_IFCHR:
mode = (mode & S_IFMT) | (mode & 0777); /* ??? */
major = req->lr_req.tmknod.major;
minor = req->lr_req.tmknod.major;
dev = makedev(major, minor);
error = fs_imknod(softc, dir, name, false,
(mode_t)mode, dev, gid, &st);
break;
case S_IFIFO:
error = fs_imkfifo(softc, dir, name, false,
(mode_t)(mode & 0777), gid, &st);
break;
case S_IFSOCK:
error = fs_imksocket(softc, dir, name, false,
(mode_t)(mode & 0777), gid, &st);
break;
default:
error = EINVAL;
break;
}
if (error == 0)
generate_qid(&st, &req->lr_resp.rmknod.qid);
return (error);
}
static int
fs_rename(void *softc, struct l9p_request *req)
{
struct fs_softc *sc = softc;
struct fs_authinfo *ai;
struct l9p_acl *oparent_acl;
struct l9p_fid *fid, *f2;
struct fs_fid *file, *f2ff;
struct stat cst, opst, npst;
int32_t op;
bool reparenting;
char *tmp;
char olddir[MAXPATHLEN], newname[MAXPATHLEN];
int error;
if (sc->fs_readonly)
return (EROFS);
/*
* Note: lr_fid represents the file that is to be renamed,
* so we must locate its parent directory and verify that
* both this parent directory and the new directory f2 are
* writable. But if the new parent directory is the same
* path as the old parent directory, our job is simpler.
*/
fid = req->lr_fid;
file = fid->lo_aux;
assert(file != NULL);
ai = file->ff_ai;
error = fs_pdir(sc, fid, olddir, sizeof(olddir), &opst);
if (error)
return (error);
f2 = req->lr_fid2;
f2ff = f2->lo_aux;
assert(f2ff != NULL);
reparenting = strcmp(olddir, f2ff->ff_name) != 0;
fillacl(file);
fillacl(f2ff);
if (fstatat(file->ff_dirfd, file->ff_name, &cst,
AT_SYMLINK_NOFOLLOW) != 0)
return (errno);
/*
* Are we moving from olddir? If so, we're unlinking
* from it, in terms of ACL access.
*/
if (reparenting) {
oparent_acl = getacl(file, -1, olddir);
error = check_access(L9P_ACOP_UNLINK,
oparent_acl, &opst, file->ff_acl, &cst, ai, (gid_t)-1);
l9p_acl_free(oparent_acl);
if (error)
return (error);
}
/*
* Now check that we're allowed to "create" a file or directory in
* f2. (Should we do this, too, only if reparenting? Maybe check
* for dir write permission if not reparenting -- but that's just
* add-file/add-subdir, which means doing this always.)
*/
if (fstatat(f2ff->ff_dirfd, f2ff->ff_name, &npst,
AT_SYMLINK_NOFOLLOW) != 0)
return (errno);
op = S_ISDIR(cst.st_mode) ? L9P_ACE_ADD_SUBDIRECTORY : L9P_ACE_ADD_FILE;
error = check_access(op, f2ff->ff_acl, &npst, NULL, NULL,
ai, (gid_t)-1);
if (error)
return (error);
/*
* Directories OK, file systems not R/O, etc; build final name.
* f2ff->ff_name cannot exceed MAXPATHLEN, but out of general
* paranoia, let's double check anyway.
*/
if (strlcpy(newname, f2ff->ff_name, sizeof(newname)) >= sizeof(newname))
return (ENAMETOOLONG);
error = fs_dpf(newname, req->lr_req.trename.name, sizeof(newname));
if (error)
return (error);
tmp = strdup(newname);
if (tmp == NULL)
return (ENOMEM);
if (renameat(file->ff_dirfd, file->ff_name, file->ff_dirfd, tmp) != 0) {
error = errno;
free(tmp);
return (error);
}
/* file has been renamed but old fid is not clunked */
free(file->ff_name);
file->ff_name = tmp;
dropacl(file);
return (0);
}
static int
fs_readlink(void *softc __unused, struct l9p_request *req)
{
struct fs_fid *file;
ssize_t linklen;
char buf[MAXPATHLEN];
int error = 0;
file = req->lr_fid->lo_aux;
assert(file);
linklen = readlinkat(file->ff_dirfd, file->ff_name, buf, sizeof(buf));
if (linklen < 0)
error = errno;
else if ((size_t)linklen >= sizeof(buf))
error = ENOMEM; /* todo: allocate dynamically */
else if ((req->lr_resp.rreadlink.target = strndup(buf,
(size_t)linklen)) == NULL)
error = ENOMEM;
return (error);
}
static int
fs_getattr(void *softc __unused, struct l9p_request *req)
{
uint64_t mask, valid;
struct fs_fid *file;
struct stat st;
int error = 0;
file = req->lr_fid->lo_aux;
assert(file);
valid = 0;
if (fstatat(file->ff_dirfd, file->ff_name, &st, AT_SYMLINK_NOFOLLOW)) {
error = errno;
goto out;
}
/* ?? Can we provide items not-requested? If so, can skip tests. */
mask = req->lr_req.tgetattr.request_mask;
if (mask & L9PL_GETATTR_MODE) {
/* It is not clear if we need any translations. */
req->lr_resp.rgetattr.mode = st.st_mode;
valid |= L9PL_GETATTR_MODE;
}
if (mask & L9PL_GETATTR_NLINK) {
req->lr_resp.rgetattr.nlink = st.st_nlink;
valid |= L9PL_GETATTR_NLINK;
}
if (mask & L9PL_GETATTR_UID) {
/* provide st_uid, or file->ff_uid? */
req->lr_resp.rgetattr.uid = st.st_uid;
valid |= L9PL_GETATTR_UID;
}
if (mask & L9PL_GETATTR_GID) {
/* provide st_gid, or file->ff_gid? */
req->lr_resp.rgetattr.gid = st.st_gid;
valid |= L9PL_GETATTR_GID;
}
if (mask & L9PL_GETATTR_RDEV) {
/* It is not clear if we need any translations. */
req->lr_resp.rgetattr.rdev = (uint64_t)st.st_rdev;
valid |= L9PL_GETATTR_RDEV;
}
if (mask & L9PL_GETATTR_ATIME) {
req->lr_resp.rgetattr.atime_sec =
(uint64_t)st.st_atimespec.tv_sec;
req->lr_resp.rgetattr.atime_nsec =
(uint64_t)st.st_atimespec.tv_nsec;
valid |= L9PL_GETATTR_ATIME;
}
if (mask & L9PL_GETATTR_MTIME) {
req->lr_resp.rgetattr.mtime_sec =
(uint64_t)st.st_mtimespec.tv_sec;
req->lr_resp.rgetattr.mtime_nsec =
(uint64_t)st.st_mtimespec.tv_nsec;
valid |= L9PL_GETATTR_MTIME;
}
if (mask & L9PL_GETATTR_CTIME) {
req->lr_resp.rgetattr.ctime_sec =
(uint64_t)st.st_ctimespec.tv_sec;
req->lr_resp.rgetattr.ctime_nsec =
(uint64_t)st.st_ctimespec.tv_nsec;
valid |= L9PL_GETATTR_CTIME;
}
if (mask & L9PL_GETATTR_BTIME) {
#if defined(HAVE_BIRTHTIME)
req->lr_resp.rgetattr.btime_sec =
(uint64_t)st.st_birthtim.tv_sec;
req->lr_resp.rgetattr.btime_nsec =
(uint64_t)st.st_birthtim.tv_nsec;
#else
req->lr_resp.rgetattr.btime_sec = 0;
req->lr_resp.rgetattr.btime_nsec = 0;
#endif
valid |= L9PL_GETATTR_BTIME;
}
if (mask & L9PL_GETATTR_INO)
valid |= L9PL_GETATTR_INO;
if (mask & L9PL_GETATTR_SIZE) {
req->lr_resp.rgetattr.size = (uint64_t)st.st_size;
valid |= L9PL_GETATTR_SIZE;
}
if (mask & L9PL_GETATTR_BLOCKS) {
req->lr_resp.rgetattr.blksize = (uint64_t)st.st_blksize;
req->lr_resp.rgetattr.blocks = (uint64_t)st.st_blocks;
valid |= L9PL_GETATTR_BLOCKS;
}
if (mask & L9PL_GETATTR_GEN) {
req->lr_resp.rgetattr.gen = st.st_gen;
valid |= L9PL_GETATTR_GEN;
}
/* don't know what to do with data version yet */
generate_qid(&st, &req->lr_resp.rgetattr.qid);
out:
req->lr_resp.rgetattr.valid = valid;
return (error);
}
/*
* Should combine some of this with wstat code.
*/
static int
fs_setattr(void *softc, struct l9p_request *req)
{
uint64_t mask;
struct fs_softc *sc = softc;
struct timespec ts[2];
struct fs_fid *file;
struct stat st;
int error = 0;
uid_t uid, gid;
file = req->lr_fid->lo_aux;
assert(file);
if (sc->fs_readonly)
return (EROFS);
/*
* As with WSTAT we have atomicity issues.
*/
mask = req->lr_req.tsetattr.valid;
if (fstatat(file->ff_dirfd, file->ff_name, &st, AT_SYMLINK_NOFOLLOW)) {
error = errno;
goto out;
}
if ((mask & L9PL_SETATTR_SIZE) && S_ISDIR(st.st_mode)) {
error = EISDIR;
goto out;
}
if (mask & L9PL_SETATTR_MODE) {
if (fchmodat(file->ff_dirfd, file->ff_name,
req->lr_req.tsetattr.mode & 0777,
AT_SYMLINK_NOFOLLOW)) {
error = errno;
goto out;
}
}
if (mask & (L9PL_SETATTR_UID | L9PL_SETATTR_GID)) {
uid = mask & L9PL_SETATTR_UID
? req->lr_req.tsetattr.uid
: (uid_t)-1;
gid = mask & L9PL_SETATTR_GID
? req->lr_req.tsetattr.gid
: (gid_t)-1;
if (fchownat(file->ff_dirfd, file->ff_name, uid, gid,
AT_SYMLINK_NOFOLLOW)) {
error = errno;
goto out;
}
}
if (mask & L9PL_SETATTR_SIZE) {
/* Truncate follows symlinks, is this OK? */
int fd = openat(file->ff_dirfd, file->ff_name, O_RDWR);
if (ftruncate(fd, (off_t)req->lr_req.tsetattr.size)) {
error = errno;
(void) close(fd);
goto out;
}
(void) close(fd);
}
if (mask & (L9PL_SETATTR_ATIME | L9PL_SETATTR_MTIME)) {
ts[0].tv_sec = st.st_atimespec.tv_sec;
ts[0].tv_nsec = st.st_atimespec.tv_nsec;
ts[1].tv_sec = st.st_mtimespec.tv_sec;
ts[1].tv_nsec = st.st_mtimespec.tv_nsec;
if (mask & L9PL_SETATTR_ATIME) {
if (mask & L9PL_SETATTR_ATIME_SET) {
ts[0].tv_sec = req->lr_req.tsetattr.atime_sec;
ts[0].tv_nsec = req->lr_req.tsetattr.atime_nsec;
} else {
if (clock_gettime(CLOCK_REALTIME, &ts[0]) != 0) {
error = errno;
goto out;
}
}
}
if (mask & L9PL_SETATTR_MTIME) {
if (mask & L9PL_SETATTR_MTIME_SET) {
ts[1].tv_sec = req->lr_req.tsetattr.mtime_sec;
ts[1].tv_nsec = req->lr_req.tsetattr.mtime_nsec;
} else {
if (clock_gettime(CLOCK_REALTIME, &ts[1]) != 0) {
error = errno;
goto out;
}
}
}
if (utimensat(file->ff_dirfd, file->ff_name, ts,
AT_SYMLINK_NOFOLLOW)) {
error = errno;
goto out;
}
}
out:
return (error);
}
static int
fs_xattrwalk(void *softc __unused, struct l9p_request *req __unused)
{
return (EOPNOTSUPP);
}
static int
fs_xattrcreate(void *softc __unused, struct l9p_request *req __unused)
{
return (EOPNOTSUPP);
}
static int
fs_readdir(void *softc __unused, struct l9p_request *req)
{
struct l9p_message msg;
struct l9p_dirent de;
struct fs_fid *file;
struct dirent *dp;
struct stat st;
uint32_t count;
int error = 0;
file = req->lr_fid->lo_aux;
assert(file);
if (file->ff_dir == NULL)
return (ENOTDIR);
pthread_mutex_lock(&file->ff_mtx);
/*
* It's not clear whether we can use the same trick for
* discarding offsets here as we do in fs_read. It
* probably should work, we'll have to see if some
* client(s) use the zero-offset thing to rescan without
* clunking the directory first.
*
* Probably the thing to do is switch to calling
* getdirentries() / getdents() directly, instead of
* going through libc.
*/
if (req->lr_req.io.offset == 0)
rewinddir(file->ff_dir);
else
seekdir(file->ff_dir, (long)req->lr_req.io.offset);
l9p_init_msg(&msg, req, L9P_PACK);
count = (uint32_t)msg.lm_size; /* in case we get no entries */
while ((dp = readdir(file->ff_dir)) != NULL) {
/*
* Although "." is forbidden in naming and ".." is
* special cased, testing shows that we must transmit
* them through readdir. (For ".." at root, we
* should perhaps alter the inode number, but not
* yet.)
*/
/*
* TODO: we do a full lstat here; could use dp->d_*
* to construct the qid more efficiently, as long
* as dp->d_type != DT_UNKNOWN.
*/
if (fs_lstatat(file, dp->d_name, &st))
continue;
de.qid.type = 0;
generate_qid(&st, &de.qid);
de.offset = (uint64_t)telldir(file->ff_dir);
de.type = dp->d_type;
de.name = dp->d_name;
/* Update count only if we completely pack the dirent. */
if (l9p_pudirent(&msg, &de) < 0)
break;
count = (uint32_t)msg.lm_size;
}
pthread_mutex_unlock(&file->ff_mtx);
req->lr_resp.io.count = count;
return (error);
}
static int
fs_fsync(void *softc __unused, struct l9p_request *req)
{
struct fs_fid *file;
int error = 0;
file = req->lr_fid->lo_aux;
assert(file);
if (fsync(file->ff_dir != NULL ? dirfd(file->ff_dir) : file->ff_fd))
error = errno;
return (error);
}
static int
fs_lock(void *softc __unused, struct l9p_request *req)
{
switch (req->lr_req.tlock.type) {
case L9PL_LOCK_TYPE_RDLOCK:
case L9PL_LOCK_TYPE_WRLOCK:
case L9PL_LOCK_TYPE_UNLOCK:
break;
default:
return (EINVAL);
}
req->lr_resp.rlock.status = L9PL_LOCK_SUCCESS;
return (0);
}
static int
fs_getlock(void *softc __unused, struct l9p_request *req)
{
/*
* Client wants to see if a request to lock a region would
* block. This is, of course, not atomic anyway, so the
* op is useless. QEMU simply says "unlocked!", so we do
* too.
*/
switch (req->lr_req.getlock.type) {
case L9PL_LOCK_TYPE_RDLOCK:
case L9PL_LOCK_TYPE_WRLOCK:
case L9PL_LOCK_TYPE_UNLOCK:
break;
default:
return (EINVAL);
}
req->lr_resp.getlock = req->lr_req.getlock;
req->lr_resp.getlock.type = L9PL_LOCK_TYPE_UNLOCK;
req->lr_resp.getlock.client_id = strdup(""); /* XXX what should go here? */
return (0);
}
static int
fs_link(void *softc __unused, struct l9p_request *req)
{
struct l9p_fid *dir;
struct fs_fid *file;
struct fs_fid *dirf;
struct stat fst, tdst;
int32_t op;
char *name;
char newname[MAXPATHLEN];
int error;
/* N.B.: lr_fid is the file to link, lr_fid2 is the target dir */
dir = req->lr_fid2;
dirf = dir->lo_aux;
assert(dirf != NULL);
name = req->lr_req.tlink.name;
error = fs_buildname(dir, name, newname, sizeof(newname));
if (error)
return (error);
file = req->lr_fid->lo_aux;
assert(file != NULL);
if (fstatat(dirf->ff_dirfd, dirf->ff_name, &tdst, AT_SYMLINK_NOFOLLOW) != 0 ||
fstatat(file->ff_dirfd, file->ff_name, &fst, AT_SYMLINK_NOFOLLOW) != 0)
return (errno);
if (S_ISDIR(fst.st_mode))
return (EISDIR);
fillacl(dirf);
op = S_ISDIR(fst.st_mode) ? L9P_ACE_ADD_SUBDIRECTORY : L9P_ACE_ADD_FILE;
error = check_access(op,
dirf->ff_acl, &tdst, NULL, NULL, file->ff_ai, (gid_t)-1);
if (error)
return (error);
if (linkat(file->ff_dirfd, file->ff_name, file->ff_dirfd,
newname, 0) != 0)
error = errno;
else
dropacl(file);
return (error);
}
static int
fs_mkdir(void *softc, struct l9p_request *req)
{
struct l9p_fid *dir;
struct stat st;
mode_t perm;
gid_t gid;
char *name;
int error;
dir = req->lr_fid;
name = req->lr_req.tmkdir.name;
perm = (mode_t)req->lr_req.tmkdir.mode;
gid = req->lr_req.tmkdir.gid;
error = fs_imkdir(softc, dir, name, false, perm, gid, &st);
if (error == 0)
generate_qid(&st, &req->lr_resp.rmkdir.qid);
return (error);
}
static int
fs_renameat(void *softc, struct l9p_request *req)
{
struct fs_softc *sc = softc;
struct l9p_fid *olddir, *newdir;
struct l9p_acl *facl;
struct fs_fid *off, *nff;
struct stat odst, ndst, fst;
int32_t op;
bool reparenting;
char *onp, *nnp;
char onb[MAXPATHLEN], nnb[MAXPATHLEN];
int error;
if (sc->fs_readonly)
return (EROFS);
olddir = req->lr_fid;
newdir = req->lr_fid2;
assert(olddir != NULL && newdir != NULL);
off = olddir->lo_aux;
nff = newdir->lo_aux;
assert(off != NULL && nff != NULL);
onp = req->lr_req.trenameat.oldname;
nnp = req->lr_req.trenameat.newname;
error = fs_buildname(olddir, onp, onb, sizeof(onb));
if (error)
return (error);
error = fs_buildname(newdir, nnp, nnb, sizeof(nnb));
if (error)
return (error);
if (fstatat(off->ff_dirfd, onb, &fst, AT_SYMLINK_NOFOLLOW) != 0)
return (errno);
reparenting = olddir != newdir &&
strcmp(off->ff_name, nff->ff_name) != 0;
if (fstatat(off->ff_dirfd, off->ff_name, &odst, AT_SYMLINK_NOFOLLOW) != 0)
return (errno);
if (!S_ISDIR(odst.st_mode))
return (ENOTDIR);
fillacl(off);
if (reparenting) {
if (fstatat(nff->ff_dirfd, nff->ff_name, &ndst, AT_SYMLINK_NOFOLLOW) != 0)
return (errno);
if (!S_ISDIR(ndst.st_mode))
return (ENOTDIR);
facl = getacl(off, -1, onb);
fillacl(nff);
error = check_access(L9P_ACOP_UNLINK,
off->ff_acl, &odst, facl, &fst, off->ff_ai, (gid_t)-1);
l9p_acl_free(facl);
if (error)
return (error);
op = S_ISDIR(fst.st_mode) ? L9P_ACE_ADD_SUBDIRECTORY :
L9P_ACE_ADD_FILE;
error = check_access(op,
nff->ff_acl, &ndst, NULL, NULL, nff->ff_ai, (gid_t)-1);
if (error)
return (error);
}
if (renameat(off->ff_dirfd, onb, nff->ff_dirfd, nnb))
error = errno;
return (error);
}
/*
* Unlink file in given directory, or remove directory in given
* directory, based on flags.
*/
static int
fs_unlinkat(void *softc, struct l9p_request *req)
{
struct fs_softc *sc = softc;
struct l9p_acl *facl;
struct l9p_fid *dir;
struct fs_fid *dirff;
struct stat dirst, fst;
char *name;
char newname[MAXPATHLEN];
int error;
if (sc->fs_readonly)
return (EROFS);
dir = req->lr_fid;
dirff = dir->lo_aux;
assert(dirff != NULL);
name = req->lr_req.tunlinkat.name;
error = fs_buildname(dir, name, newname, sizeof(newname));
if (error)
return (error);
if (fstatat(dirff->ff_dirfd, newname, &fst, AT_SYMLINK_NOFOLLOW) != 0 ||
fstatat(dirff->ff_dirfd, dirff->ff_name, &dirst, AT_SYMLINK_NOFOLLOW) != 0)
return (errno);
fillacl(dirff);
facl = getacl(dirff, -1, newname);
error = check_access(L9P_ACOP_UNLINK,
dirff->ff_acl, &dirst, facl, &fst, dirff->ff_ai, (gid_t)-1);
l9p_acl_free(facl);
if (error)
return (error);
if (req->lr_req.tunlinkat.flags & L9PL_AT_REMOVEDIR) {
if (unlinkat(dirff->ff_dirfd, newname, AT_REMOVEDIR) != 0)
error = errno;
} else {
if (unlinkat(dirff->ff_dirfd, newname, 0) != 0)
error = errno;
}
return (error);
}
static void
fs_freefid(void *softc __unused, struct l9p_fid *fid)
{
struct fs_fid *f = fid->lo_aux;
struct fs_authinfo *ai;
uint32_t newcount;
if (f == NULL) {
/* Nothing to do here */
return;
}
if (f->ff_fd != -1)
close(f->ff_fd);
if (f->ff_dir)
closedir(f->ff_dir);
pthread_mutex_destroy(&f->ff_mtx);
free(f->ff_name);
ai = f->ff_ai;
l9p_acl_free(f->ff_acl);
free(f);
pthread_mutex_lock(&ai->ai_mtx);
newcount = --ai->ai_refcnt;
pthread_mutex_unlock(&ai->ai_mtx);
if (newcount == 0) {
/*
* We *were* the last ref, no one can have gained a ref.
*/
L9P_LOG(L9P_DEBUG, "dropped last ref to authinfo %p",
(void *)ai);
pthread_mutex_destroy(&ai->ai_mtx);
free(ai);
} else {
L9P_LOG(L9P_DEBUG, "authinfo %p now used by %lu",
(void *)ai, (u_long)newcount);
}
}
int
l9p_backend_fs_init(struct l9p_backend **backendp, int rootfd, bool ro)
{
struct l9p_backend *backend;
struct fs_softc *sc;
int error;
#if defined(WITH_CASPER)
cap_channel_t *capcas;
#endif
if (!fs_attach_mutex_inited) {
error = pthread_mutex_init(&fs_attach_mutex, NULL);
if (error) {
errno = error;
return (-1);
}
fs_attach_mutex_inited = true;
}
backend = l9p_malloc(sizeof(*backend));
backend->attach = fs_attach;
backend->clunk = fs_clunk;
backend->create = fs_create;
backend->open = fs_open;
backend->read = fs_read;
backend->remove = fs_remove;
backend->stat = fs_stat;
backend->walk = fs_walk;
backend->write = fs_write;
backend->wstat = fs_wstat;
backend->statfs = fs_statfs;
backend->lopen = fs_lopen;
backend->lcreate = fs_lcreate;
backend->symlink = fs_symlink;
backend->mknod = fs_mknod;
backend->rename = fs_rename;
backend->readlink = fs_readlink;
backend->getattr = fs_getattr;
backend->setattr = fs_setattr;
backend->xattrwalk = fs_xattrwalk;
backend->xattrcreate = fs_xattrcreate;
backend->readdir = fs_readdir;
backend->fsync = fs_fsync;
backend->lock = fs_lock;
backend->getlock = fs_getlock;
backend->link = fs_link;
backend->mkdir = fs_mkdir;
backend->renameat = fs_renameat;
backend->unlinkat = fs_unlinkat;
backend->freefid = fs_freefid;
sc = l9p_malloc(sizeof(*sc));
sc->fs_rootfd = rootfd;
sc->fs_readonly = ro;
backend->softc = sc;
#if defined(WITH_CASPER)
capcas = cap_init();
if (capcas == NULL)
return (-1);
sc->fs_cappwd = cap_service_open(capcas, "system.pwd");
if (sc->fs_cappwd == NULL)
return (-1);
sc->fs_capgrp = cap_service_open(capcas, "system.grp");
if (sc->fs_capgrp == NULL)
return (-1);
cap_setpassent(sc->fs_cappwd, 1);
cap_setgroupent(sc->fs_capgrp, 1);
cap_close(capcas);
#else
setpassent(1);
#endif
*backendp = backend;
return (0);
}
Reference in New Issue View Git Blame Copy Permalink