/*-
* Copyright (c) 2008, 2009, 2019, 2020, 2023 The NetBSD Foundation, Inc.
* All rights reserved.
*
* This code is derived from software contributed to The NetBSD Foundation
* by Andrew Doran.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
/*
* Copyright (c) 1989, 1993
* The Regents of the University of California. All rights reserved.
* (c) UNIX System Laboratories, Inc.
* All or some portions of this file are derived from material licensed
* to the University of California by American Telephone and Telegraph
* Co. or Unix System Laboratories, Inc. and are reproduced herein with
* the permission of UNIX System Laboratories, Inc.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
* 3. Neither the name of the University nor the names of its contributors
* may be used to endorse or promote products derived from this software
* without specific prior written permission.
*
* THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
* ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
*
* @(#)vfs_syscalls.c 8.42 (Berkeley) 7/31/95
*/
static int
mount_update(struct lwp *l, struct vnode *vp, const char *path, int flags,
void *data, size_t *data_len)
{
struct mount *mp;
int error = 0, saved_flags;
mp = vp->v_mount;
saved_flags = mp->mnt_flag;
/* We can operate only on VV_ROOT nodes. */
if ((vp->v_vflag & VV_ROOT) == 0) {
error = EINVAL;
goto out;
}
/*
* We only allow the filesystem to be reloaded if it
* is currently mounted read-only. Additionally, we
* prevent read-write to read-only downgrades.
*/
if ((flags & (MNT_RELOAD | MNT_RDONLY)) != 0 &&
(mp->mnt_flag & MNT_RDONLY) == 0 &&
(mp->mnt_iflag & IMNT_CAN_RWTORO) == 0) {
error = EOPNOTSUPP; /* Needs translation */
goto out;
}
/*
* Enabling MNT_UNION requires a covered mountpoint and
* must not happen on the root mount.
*/
if ((flags & MNT_UNION) != 0 && mp->mnt_vnodecovered == NULLVP) {
error = EOPNOTSUPP;
goto out;
}
/*
* Set the mount level flags.
*/
if ((flags & MNT_RDONLY) != (mp->mnt_flag & MNT_RDONLY)) {
if ((flags & MNT_RDONLY))
mp->mnt_iflag |= IMNT_WANTRDONLY;
else
mp->mnt_iflag |= IMNT_WANTRDWR;
}
mp->mnt_flag &= ~MNT_BASIC_FLAGS;
mp->mnt_flag |= flags & MNT_BASIC_FLAGS;
if ((mp->mnt_iflag & IMNT_WANTRDONLY))
mp->mnt_flag &= ~MNT_RDONLY;
error = VFS_MOUNT(mp, path, data, data_len);
if (error && data != NULL) {
int error2;
/*
* Update failed; let's try and see if it was an
* export request. For compat with 3.0 and earlier.
*/
error2 = vfs_hooks_reexport(mp, path, data);
/*
* Only update error code if the export request was
* understood but some problem occurred while
* processing it.
*/
if (error2 != EJUSTRETURN)
error = error2;
}
if (error) {
/*
* Historically, filesystem types were identified by numbers.
* If we get an integer for the filesystem type instead of a
* string, we check to see if it matches one of the historic
* filesystem types.
*/
u_long fsindex = (u_long)fstype;
if (fsindex >= nmountcompatnames ||
mountcompatnames[fsindex] == NULL)
return ENODEV;
strlcpy(fstypename, mountcompatnames[fsindex],
sizeof(fstypename));
}
/* Accept `ufs' as an alias for `ffs', for compatibility. */
if (strcmp(fstypename, "ufs") == 0)
fstypename[0] = 'f';
if ((*vfsops = vfs_getopsbyname(fstypename)) != NULL)
return 0;
/* If we can autoload a vfs module, try again */
(void)module_autoload(fstypename, MODULE_CLASS_VFS);
if ((*vfsops = vfs_getopsbyname(fstypename)) != NULL)
return 0;
return ENODEV;
}
static int
mount_getargs(struct lwp *l, struct vnode *vp, const char *path, int flags,
void *data, size_t *data_len)
{
struct mount *mp;
int error;
/* If MNT_GETARGS is specified, it should be the only flag. */
if (flags & ~MNT_GETARGS)
return EINVAL;
mp = vp->v_mount;
/* XXX: probably some notion of "can see" here if we want isolation. */
error = kauth_authorize_system(l->l_cred, KAUTH_SYSTEM_MOUNT,
KAUTH_REQ_SYSTEM_MOUNT_GET, mp, data, NULL);
if (error)
return error;
/*
* We allow data to be NULL, even for userspace. Some fs's don't need
* it. The others will handle NULL.
*/
if (data != NULL && data_seg == UIO_USERSPACE) {
if (data_len == 0) {
/* No length supplied, use default for filesystem */
data_len = vfsops->vfs_min_mount_data;
/*
* Hopefully a longer buffer won't make copyin() fail.
* For compatibility with 3.0 and earlier.
*/
if (flags & MNT_UPDATE
&& data_len < sizeof (struct mnt_export_args30))
data_len = sizeof (struct mnt_export_args30);
}
if ((data_len == 0) || (data_len > VFS_MAX_MOUNT_DATA)) {
error = EINVAL;
goto done;
}
alloc_sz = data_len;
data_buf = kmem_alloc(alloc_sz, KM_SLEEP);
/* NFS needs the buffer even for mnt_getargs .... */
error = copyin(data, data_buf, data_len);
if (error != 0)
goto done;
}
static int
do_sys_quotactl_cursoratend(struct mount *mp, struct quotakcursor *cursor_u,
int *ret_u)
{
struct quotakcursor cursor_k;
int ret_k;
int error;
static int
do_sys_quotactl_quotaon(struct mount *mp, int idtype, const char *path_u)
{
char *path_k;
int error;
/* XXX this should probably be a struct pathbuf */
path_k = PNBUF_GET();
error = copyin(path_u, path_k, PATH_MAX);
if (error) {
PNBUF_PUT(path_k);
return error;
}
error = vfs_quotactl_quotaon(mp, idtype, path_k);
PNBUF_PUT(path_k);
return error;
}
static int
do_sys_quotactl_quotaoff(struct mount *mp, int idtype)
{
return vfs_quotactl_quotaoff(mp, idtype);
}
int
do_sys_quotactl(const char *path_u, const struct quotactl_args *args)
{
struct mount *mp;
struct vnode *vp;
int error;
int
dostatvfs(struct mount *mp, struct statvfs *sp, struct lwp *l, int flags,
int root)
{
struct cwdinfo *cwdi = l->l_proc->p_cwdi;
bool chrooted;
int error = 0;
KASSERT(l == curlwp);
/*
* This is safe unlocked. cwdi_rdir never goes non-NULL -> NULL,
* since it would imply chroots can be escaped. Just make sure this
* routine is self-consistent.
*/
chrooted = (atomic_load_relaxed(&cwdi->cwdi_rdir) != NULL);
/*
* If MNT_NOWAIT or MNT_LAZY is specified, do not
* refresh the fsstat cache. MNT_WAIT or MNT_LAZY
* overrides MNT_NOWAIT.
*/
if (flags == MNT_NOWAIT || flags == MNT_LAZY ||
(flags != MNT_WAIT && flags != 0)) {
memcpy(sp, &mp->mnt_stat, sizeof(*sp));
} else {
/* Get the filesystem stats now */
memset(sp, 0, sizeof(*sp));
if ((error = VFS_STATVFS(mp, sp)) != 0)
return error;
if (!chrooted)
(void)memcpy(&mp->mnt_stat, sp, sizeof(mp->mnt_stat));
}
bp = path + MAXPATHLEN;
*--bp = '\0';
rw_enter(&cwdi->cwdi_lock, RW_READER);
error = getcwd_common(cwdi->cwdi_rdir, rootvnode, &bp, path,
MAXPATHLEN / 2, 0, l);
rw_exit(&cwdi->cwdi_lock);
if (error) {
PNBUF_PUT(path);
return error;
}
len = strlen(bp);
if (len != 1) {
/*
* for mount points that are below our root, we can see
* them, so we fix up the pathname and return them. The
* rest we cannot see, so we don't allow viewing the
* data.
*/
if (strncmp(bp, sp->f_mntonname, len) == 0 &&
((c = sp->f_mntonname[len]) == '/' || c == '\0')) {
(void)strlcpy(sp->f_mntonname,
c == '\0' ? "/" : &sp->f_mntonname[len],
sizeof(sp->f_mntonname));
} else {
if (root)
(void)strlcpy(sp->f_mntonname, "/",
sizeof(sp->f_mntonname));
else
error = EPERM;
}
}
PNBUF_PUT(path);
}
sp->f_flag = mp->mnt_flag & MNT_VISFLAGMASK;
return error;
}
/*
* Get filesystem statistics by path.
*/
int
do_sys_pstatvfs(struct lwp *l, const char *path, int flags, struct statvfs *sb)
{
struct mount *mp;
int error;
struct vnode *vp;
/*
* Get filesystem statistics by fd.
*/
int
do_sys_fstatvfs(struct lwp *l, int fd, int flags, struct statvfs *sb)
{
file_t *fp;
struct mount *mp;
int error;
/* fd_getvnode() will use the descriptor for us */
if ((error = fd_getvnode(fd, &fp)) != 0)
return (error);
mp = fp->f_vnode->v_mount;
error = dostatvfs(mp, sb, curlwp, flags, 1);
fd_putfile(fd);
return error;
}
/*
* Change current working directory to a given file descriptor.
*/
int
do_sys_fchdir(struct lwp *l, int fd, register_t *retval)
{
struct proc *p = l->l_proc;
struct cwdinfo *cwdi;
struct vnode *vp, *tdp;
struct mount *mp;
file_t *fp;
int error;
/* fd_getvnode() will use the descriptor for us */
if ((error = fd_getvnode(fd, &fp)) != 0)
return error;
vp = fp->f_vnode;
/*
* Disallow changing to a directory not under the process's
* current root directory (if there is one).
*/
cwdi = p->p_cwdi;
rw_enter(&cwdi->cwdi_lock, RW_WRITER);
if (cwdi->cwdi_rdir && !vn_isunder(vp, NULL, l)) {
vrele(vp);
error = EPERM; /* operation not permitted */
} else {
vrele(cwdi->cwdi_cdir);
cwdi->cwdi_cdir = vp;
}
rw_exit(&cwdi->cwdi_lock);
out:
fd_putfile(fd);
return error;
}
/*
* Change current working directory to a given file descriptor.
*/
/* ARGSUSED */
int
sys_fchdir(struct lwp *l, const struct sys_fchdir_args *uap,
register_t *retval)
{
/* {
syscallarg(int) fd;
} */
/*
* Change this process's notion of the root directory to a given file
* descriptor.
*/
int
sys_fchroot(struct lwp *l, const struct sys_fchroot_args *uap,
register_t *retval)
{
struct vnode *vp;
file_t *fp;
int error, fd = SCARG(uap, fd);
if ((error = kauth_authorize_system(l->l_cred, KAUTH_SYSTEM_CHROOT,
KAUTH_REQ_SYSTEM_CHROOT_FCHROOT, NULL, NULL, NULL)) != 0)
return error;
/* fd_getvnode() will use the descriptor for us */
if ((error = fd_getvnode(fd, &fp)) != 0)
return error;
vp = fp->f_vnode;
vn_lock(vp, LK_SHARED | LK_RETRY);
if (vp->v_type != VDIR)
error = ENOTDIR;
else
error = VOP_ACCESS(vp, VEXEC, l->l_cred);
VOP_UNLOCK(vp);
if (error)
goto out;
vref(vp);
change_root(vp);
out:
fd_putfile(fd);
return (error);
}
/*
* Change current working directory (``.'').
*/
int
do_sys_chdir(struct lwp *l, const char *path, enum uio_seg seg,
register_t *retval)
{
struct proc *p = l->l_proc;
struct cwdinfo * cwdi;
int error;
struct vnode *vp;
/*
* Common routine for chroot and fchroot.
* NB: callers need to properly authorize the change root operation.
*/
void
change_root(struct vnode *vp)
{
kauth_cred_t ncred;
struct lwp *l = curlwp;
struct proc *p = l->l_proc;
struct cwdinfo *cwdi = p->p_cwdi;
ncred = kauth_cred_alloc();
rw_enter(&cwdi->cwdi_lock, RW_WRITER);
if (cwdi->cwdi_rdir != NULL)
vrele(cwdi->cwdi_rdir);
cwdi->cwdi_rdir = vp;
/*
* Prevent escaping from chroot by putting the root under
* the working directory. Silently chdir to / if we aren't
* already there.
*/
if (!vn_isunder(cwdi->cwdi_cdir, vp, l)) {
/*
* XXX would be more failsafe to change directory to a
* deadfs node here instead
*/
vrele(cwdi->cwdi_cdir);
vref(vp);
cwdi->cwdi_cdir = vp;
}
rw_exit(&cwdi->cwdi_lock);
/* Get a write lock on the process credential. */
proc_crmod_enter();
/* Broadcast our credentials to the process and other LWPs. */
proc_crmod_leave(ncred, p->p_cred, true);
}
/*
* Common routine for chroot and chdir.
* XXX "where" should be enum uio_seg
*/
int
chdir_lookup(const char *path, int where, struct vnode **vpp, struct lwp *l)
{
struct pathbuf *pb;
struct nameidata nd;
int error;
if (error)
vput(*vpp);
else
VOP_UNLOCK(*vpp);
return (error);
}
/*
* Internals of sys_open - path has already been converted into a pathbuf
* (so we can easily reuse this function from other parts of the kernel,
* like posix_spawn post-processing).
*/
int
do_open(lwp_t *l, struct vnode *dvp, struct pathbuf *pb, int open_flags,
int open_mode, int *fd)
{
struct proc *p = l->l_proc;
struct cwdinfo *cwdi = p->p_cwdi;
file_t *fp;
struct vnode *vp;
int dupfd;
bool dupfd_move;
int flags, cmode;
int indx, error;
if (open_flags & O_SEARCH) {
open_flags &= ~(int)O_SEARCH;
}
/*
* Only one of the O_EXEC, O_RDONLY, O_WRONLY and O_RDWR flags
* may be specified.
*/
if ((open_flags & O_EXEC) && (open_flags & O_ACCMODE))
return EINVAL;
static int
do_sys_openat(lwp_t *l, int fdat, const char *path, int flags,
int mode, int *fd)
{
file_t *dfp = NULL;
struct vnode *dvp = NULL;
struct pathbuf *pb;
const char *pathstring = NULL;
int error;
if (path == NULL) {
MODULE_HOOK_CALL(vfs_openat_10_hook, (&pb), enosys(), error);
if (error == ENOSYS)
goto no_compat;
if (error)
return error;
} else {
no_compat:
error = pathbuf_copyin(path, &pb);
if (error)
return error;
}
pathstring = pathbuf_stringcopy_get(pb);
/*
* fdat is ignored if:
* 1) if fdat is AT_FDCWD, which means use current directory as base.
* 2) if path is absolute, then fdat is useless.
*/
if (fdat != AT_FDCWD && pathstring[0] != '/') {
/* fd_getvnode() will use the descriptor for us */
if ((error = fd_getvnode(fdat, &dfp)) != 0)
goto out;
int
do_posix_mknodat(struct lwp *l, int fdat, const char *pathname, mode_t mode,
dev_t dev)
{
/*
* The POSIX mknod(2) call is an alias for mkfifo(2) for S_IFIFO
* in mode and dev=0.
*
* In all the other cases it's implementation defined behavior.
*/
/*
* Common code for all sys_stat functions, including compat versions.
*/
int
do_sys_stat(const char *userpath, unsigned int nd_flag, struct stat *sb)
{
int
do_sys_statat(struct lwp *l, int fdat, const char *userpath,
unsigned int nd_flag, struct stat *sb)
{
int error;
struct pathbuf *pb;
struct nameidata nd;
KASSERT(l != NULL || fdat == AT_FDCWD);
error = pathbuf_copyin(userpath, &pb);
if (error) {
return error;
}
/*
* Get file status; this version does not follow links.
*/
/* ARGSUSED */
int
sys___lstat50(struct lwp *l, const struct sys___lstat50_args *uap,
register_t *retval)
{
/* {
syscallarg(const char *) path;
syscallarg(struct stat *) ub;
} */
struct stat sb;
int error;
/*
* Change flags of a file given a file descriptor.
*/
/* ARGSUSED */
int
sys_fchflags(struct lwp *l, const struct sys_fchflags_args *uap,
register_t *retval)
{
/* {
syscallarg(int) fd;
syscallarg(u_long) flags;
} */
struct vnode *vp;
file_t *fp;
int error;
/* fd_getvnode() will use the descriptor for us */
if ((error = fd_getvnode(SCARG(uap, fd), &fp)) != 0)
return (error);
vp = fp->f_vnode;
error = change_flags(vp, SCARG(uap, flags), l);
VOP_UNLOCK(vp);
fd_putfile(SCARG(uap, fd));
return (error);
}
/*
* Change flags of a file given a path name; this version does
* not follow links.
*/
int
sys_lchflags(struct lwp *l, const struct sys_lchflags_args *uap,
register_t *retval)
{
/* {
syscallarg(const char *) path;
syscallarg(u_long) flags;
} */
struct vnode *vp;
int error;
/*
* Change mode of a file given a file descriptor.
*/
/* ARGSUSED */
int
sys_fchmod(struct lwp *l, const struct sys_fchmod_args *uap,
register_t *retval)
{
/* {
syscallarg(int) fd;
syscallarg(int) mode;
} */
file_t *fp;
int error;
/* fd_getvnode() will use the descriptor for us */
if ((error = fd_getvnode(SCARG(uap, fd), &fp)) != 0)
return (error);
error = change_mode(fp->f_vnode, SCARG(uap, mode), l);
fd_putfile(SCARG(uap, fd));
return (error);
}
/*
* Common routine to set ownership given a vnode.
*/
static int
change_owner(struct vnode *vp, uid_t uid, gid_t gid, struct lwp *l,
int posix_semantics)
{
struct vattr vattr;
mode_t newmode;
int error;
#define CHANGED(x) ((int)(x) != -1)
newmode = vattr.va_mode;
if (posix_semantics) {
/*
* POSIX/XPG semantics: if the caller is not the super-user,
* clear set-user-id and set-group-id bits. Both POSIX and
* the XPG consider the behaviour for calls by the super-user
* implementation-defined; we leave the set-user-id and set-
* group-id settings intact in that case.
*/
if (vattr.va_mode & S_ISUID) {
if (kauth_authorize_vnode(l->l_cred,
KAUTH_VNODE_RETAIN_SUID, vp, NULL, EPERM) != 0)
newmode &= ~S_ISUID;
}
if (vattr.va_mode & S_ISGID) {
if (kauth_authorize_vnode(l->l_cred,
KAUTH_VNODE_RETAIN_SGID, vp, NULL, EPERM) != 0)
newmode &= ~S_ISGID;
}
} else {
/*
* NetBSD semantics: when changing owner and/or group,
* clear the respective bit(s).
*/
if (CHANGED(uid))
newmode &= ~S_ISUID;
if (CHANGED(gid))
newmode &= ~S_ISGID;
}
/* Update va_mode iff altered. */
if (vattr.va_mode == newmode)
newmode = VNOVAL;
/*
* Set the access and modification times given a path name; this
* version follows links.
*/
/* ARGSUSED */
int
sys___utimes50(struct lwp *l, const struct sys___utimes50_args *uap,
register_t *retval)
{
/* {
syscallarg(const char *) path;
syscallarg(const struct timeval *) tptr;
} */
/* fd_getvnode() will use the descriptor for us */
if ((error = fd_getvnode(SCARG(uap, fd), &fp)) != 0)
return (error);
error = do_sys_utimensat(l, AT_FDCWD, fp->f_vnode, NULL, 0,
SCARG(uap, tptr), UIO_USERSPACE);
fd_putfile(SCARG(uap, fd));
return (error);
}
/*
* Set the access and modification times given a path name; this
* version does not follow links.
*/
int
sys___lutimes50(struct lwp *l, const struct sys___lutimes50_args *uap,
register_t *retval)
{
/* {
syscallarg(const char *) path;
syscallarg(const struct timeval *) tptr;
} */
/*
* Common routine to set access and modification times given a vnode.
*/
int
do_sys_utimens(struct lwp *l, struct vnode *vp, const char *path, int flag,
const struct timespec *tptr, enum uio_seg seg)
{
int
do_sys_utimensat(struct lwp *l, int fdat, struct vnode *vp,
const char *path, int flag, const struct timespec *tptr, enum uio_seg seg)
{
struct vattr vattr;
int error, dorele = 0;
namei_simple_flags_t sflags;
bool vanull, setbirthtime;
struct timespec ts[2];
KASSERT(l != NULL || fdat == AT_FDCWD);
/*
* I have checked all callers and they pass either FOLLOW,
* NOFOLLOW, or 0 (when they don't pass a path), and NOFOLLOW
* is 0. More to the point, they don't pass anything else.
* Let's keep it that way at least until the namei interfaces
* are fully sanitized.
*/
KASSERT(flag == NOFOLLOW || flag == FOLLOW);
sflags = (flag == FOLLOW) ?
NSM_FOLLOW_TRYEMULROOT : NSM_NOFOLLOW_TRYEMULROOT;
/*
* Sync an open file.
*/
/* ARGSUSED */
int
sys_fsync(struct lwp *l, const struct sys_fsync_args *uap, register_t *retval)
{
/* {
syscallarg(int) fd;
} */
struct vnode *vp;
file_t *fp;
int error;
/* fd_getvnode() will use the descriptor for us */
if ((error = fd_getvnode(SCARG(uap, fd), &fp)) != 0)
return (error);
vp = fp->f_vnode;
vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
error = VOP_FSYNC(vp, fp->f_cred, FSYNC_WAIT, 0, 0);
VOP_UNLOCK(vp);
fd_putfile(SCARG(uap, fd));
return (error);
}
/*
* Sync a range of file data. API modeled after that found in AIX.
*
* FDATASYNC indicates that we need only save enough metadata to be able
* to re-read the written data.
*/
/* ARGSUSED */
int
sys_fsync_range(struct lwp *l, const struct sys_fsync_range_args *uap,
register_t *retval)
{
/* {
syscallarg(int) fd;
syscallarg(int) flags;
syscallarg(off_t) start;
syscallarg(off_t) length;
} */
struct vnode *vp;
file_t *fp;
int flags, nflags;
off_t s, e, len;
int error;
/* fd_getvnode() will use the descriptor for us */
if ((error = fd_getvnode(SCARG(uap, fd), &fp)) != 0)
return (error);
flags = SCARG(uap, flags);
if (((flags & (FDATASYNC | FFILESYNC)) == 0) ||
((~flags & (FDATASYNC | FFILESYNC)) == 0)) {
error = EINVAL;
goto out;
}
/* Now set up the flags for value(s) to pass to VOP_FSYNC() */
if (flags & FDATASYNC)
nflags = FSYNC_DATAONLY | FSYNC_WAIT;
else
nflags = FSYNC_WAIT;
if (flags & FDISKSYNC)
nflags |= FSYNC_CACHE;
len = SCARG(uap, length);
/* If length == 0, we do the whole file, and s = e = 0 will do that */
if (len) {
s = SCARG(uap, start);
if (s < 0 || len < 0 || len > OFF_T_MAX - s) {
error = EINVAL;
goto out;
}
e = s + len;
KASSERT(s <= e);
} else {
e = 0;
s = 0;
}
/*
* Rename files. Source and destination must either both be directories,
* or both not be directories. If target is a directory, it must be empty.
* If `from' and `to' refer to the same object, the value of the `retain'
* argument is used to determine whether `from' will be
*
* (retain == 0) deleted unless `from' and `to' refer to the same
* object in the file system's name space (BSD).
* (retain == 1) always retained (POSIX).
*
* XXX Synchronize with nfsrv_rename in nfs_serv.c.
*/
int
do_sys_rename(const char *from, const char *to, enum uio_seg seg, int retain)
{
return do_sys_renameat(NULL, AT_FDCWD, from, AT_FDCWD, to, seg,
retain);
}
static int
do_sys_renameat(struct lwp *l, int fromfd, const char *from, int tofd,
const char *to, enum uio_seg seg, int retain)
{
struct pathbuf *fpb, *tpb;
struct nameidata fnd, tnd;
struct vnode *fdvp, *fvp;
struct vnode *tdvp, *tvp;
struct mount *mp, *tmp;
int error;
/*
* Lookup from.
*
* XXX LOCKPARENT is wrong because we don't actually want it
* locked yet, but (a) namei is insane, and (b) VOP_RENAME is
* insane, so for the time being we need to leave it like this.
*/
NDINIT(&fnd, DELETE, (LOCKPARENT | TRYEMULROOT), fpb);
if ((error = fd_nameiat(l, fromfd, &fnd)) != 0)
goto out2;
/*
* Pull out the important results of the lookup, fdvp and fvp.
* Of course, fvp is bogus because we're about to unlock fdvp.
*/
fdvp = fnd.ni_dvp;
fvp = fnd.ni_vp;
mp = fdvp->v_mount;
KASSERT(fdvp != NULL);
KASSERT(fvp != NULL);
KASSERT(fdvp == fvp || VOP_ISLOCKED(fdvp) == LK_EXCLUSIVE);
/*
* Bracket the operation with fstrans_start()/fstrans_done().
*
* Inside the bracket this file system cannot be unmounted so
* a vnode on this file system cannot change its v_mount.
* A vnode on another file system may still change to dead mount.
*/
fstrans_start(mp);
/*
* Make sure neither fdvp nor fvp is locked.
*/
if (fdvp != fvp)
VOP_UNLOCK(fdvp);
/* XXX KASSERT(VOP_ISLOCKED(fdvp) != LK_EXCLUSIVE); */
/* XXX KASSERT(VOP_ISLOCKED(fvp) != LK_EXCLUSIVE); */
/*
* Reject renaming `.' and `..'. Can't do this until after
* namei because we need namei's parsing to find the final
* component name. (namei should just leave us with the final
* component name and not look it up itself, but anyway...)
*
* This was here before because we used to relookup from
* instead of to and relookup requires the caller to check
* this, but now file systems may depend on this check, so we
* must retain it until the file systems are all rototilled.
*/
if ((fnd.ni_cnd.cn_namelen == 1 &&
fnd.ni_cnd.cn_nameptr[0] == '.') ||
(fnd.ni_cnd.cn_namelen == 2 &&
fnd.ni_cnd.cn_nameptr[0] == '.' &&
fnd.ni_cnd.cn_nameptr[1] == '.')) {
error = EINVAL; /* XXX EISDIR? */
goto abort0;
}
/*
* Lookup to.
*
* XXX LOCKPARENT is wrong, but...insanity, &c. Also, using
* fvp here to decide whether to add CREATEDIR is a load of
* bollocks because fvp might be the wrong node by now, since
* fdvp is unlocked.
*
* XXX Why not pass CREATEDIR always?
*/
NDINIT(&tnd, RENAME,
(LOCKPARENT | NOCACHE | TRYEMULROOT |
((fvp->v_type == VDIR)? CREATEDIR : 0)),
tpb);
if ((error = fd_nameiat(l, tofd, &tnd)) != 0)
goto abort0;
/*
* Pull out the important results of the lookup, tdvp and tvp.
* Of course, tvp is bogus because we're about to unlock tdvp.
*/
tdvp = tnd.ni_dvp;
tvp = tnd.ni_vp;
KASSERT(tdvp != NULL);
KASSERT(tdvp == tvp || VOP_ISLOCKED(tdvp) == LK_EXCLUSIVE);
if (fvp->v_type == VDIR)
tnd.ni_cnd.cn_flags |= WILLBEDIR;
/*
* Make sure neither tdvp nor tvp is locked.
*/
if (tdvp != tvp)
VOP_UNLOCK(tdvp);
/* XXX KASSERT(VOP_ISLOCKED(tdvp) != LK_EXCLUSIVE); */
/* XXX KASSERT((tvp == NULL) || (VOP_ISLOCKED(tvp) != LK_EXCLUSIVE)); */
/*
* Reject renaming onto `.' or `..'. relookup is unhappy with
* these, which is why we must do this here. Once upon a time
* we relooked up from instead of to, and consequently didn't
* need this check, but now that we relookup to instead of
* from, we need this; and we shall need it forever forward
* until the VOP_RENAME protocol changes, because file systems
* will no doubt begin to depend on this check.
*/
if (tnd.ni_cnd.cn_namelen == 1 && tnd.ni_cnd.cn_nameptr[0] == '.') {
error = EISDIR;
goto abort1;
}
if (tnd.ni_cnd.cn_namelen == 2 &&
tnd.ni_cnd.cn_nameptr[0] == '.' &&
tnd.ni_cnd.cn_nameptr[1] == '.') {
error = EINVAL;
goto abort1;
}
/*
* Make sure the mount points match. Although we don't hold
* any vnode locks, the v_mount on fdvp file system are stable.
*
* Unmounting another file system at an inopportune moment may
* cause tdvp to disappear and change its v_mount to dead.
*
* So in either case different v_mount means cross-device rename.
*/
KASSERT(mp != NULL);
tmp = tdvp->v_mount;
if (mp != tmp) {
error = EXDEV;
goto abort1;
}
/*
* Take the vfs rename lock to avoid cross-directory screw cases.
* Nothing is locked currently, so taking this lock is safe.
*/
error = VFS_RENAMELOCK_ENTER(mp);
if (error)
goto abort1;
/*
* Now fdvp, fvp, tdvp, and (if nonnull) tvp are referenced,
* and nothing is locked except for the vfs rename lock.
*
* The next step is a little rain dance to conform to the
* insane lock protocol, even though it does nothing to ward
* off race conditions.
*
* We need tdvp and tvp to be locked. However, because we have
* unlocked tdvp in order to hold no locks while we take the
* vfs rename lock, tvp may be wrong here, and we can't safely
* lock it even if the sensible file systems will just unlock
* it straight away. Consequently, we must lock tdvp and then
* relookup tvp to get it locked.
*
* Finally, because the VOP_RENAME protocol is brain-damaged
* and various file systems insanely depend on the semantics of
* this brain damage, the lookup of to must be the last lookup
* before VOP_RENAME.
*/
vn_lock(tdvp, LK_EXCLUSIVE | LK_RETRY);
error = relookup(tdvp, &tnd.ni_vp, &tnd.ni_cnd, 0);
if (error)
goto abort2;
/*
* Drop the old tvp and pick up the new one -- which might be
* the same, but that doesn't matter to us. After this, tdvp
* and tvp should both be locked.
*/
if (tvp != NULL)
vrele(tvp);
tvp = tnd.ni_vp;
KASSERT(VOP_ISLOCKED(tdvp) == LK_EXCLUSIVE);
KASSERT(tvp == NULL || VOP_ISLOCKED(tvp) == LK_EXCLUSIVE);
/*
* The old do_sys_rename had various consistency checks here
* involving fvp and tvp. fvp is bogus already here, and tvp
* will become bogus soon in any sensible file system, so the
* only purpose in putting these checks here is to give lip
* service to these screw cases and to acknowledge that they
* exist, not actually to handle them, but here you go
* anyway...
*/
/*
* Acknowledge that directories and non-directories aren't
* supposed to mix.
*/
if (tvp != NULL) {
if (fvp->v_type == VDIR && tvp->v_type != VDIR) {
error = ENOTDIR;
goto abort3;
} else if (fvp->v_type != VDIR && tvp->v_type == VDIR) {
error = EISDIR;
goto abort3;
}
}
/*
* Acknowledge some random screw case, among the dozens that
* might arise.
*/
if (fvp == tdvp) {
error = EINVAL;
goto abort3;
}
/*
* Acknowledge that POSIX has a wacky screw case.
*
* XXX Eventually the retain flag needs to be passed on to
* VOP_RENAME.
*/
if (fvp == tvp) {
if (retain) {
error = 0;
goto abort3;
} else if (fdvp == tdvp &&
fnd.ni_cnd.cn_namelen == tnd.ni_cnd.cn_namelen &&
0 == memcmp(fnd.ni_cnd.cn_nameptr, tnd.ni_cnd.cn_nameptr,
fnd.ni_cnd.cn_namelen)) {
error = 0;
goto abort3;
}
}
/*
* Make sure veriexec can screw us up. (But a race can screw
* up veriexec, of course -- remember, fvp and (soon) tvp are
* bogus.)
*/
#if NVERIEXEC > 0
{
char *f1, *f2;
size_t f1_len;
size_t f2_len;
/*
* Read a block of directory entries in a file system independent format.
*/
int
sys___getdents30(struct lwp *l, const struct sys___getdents30_args *uap,
register_t *retval)
{
/* {
syscallarg(int) fd;
syscallarg(char *) buf;
syscallarg(size_t) count;
} */
file_t *fp;
int error, done;
/* fd_getvnode() will use the descriptor for us */
if ((error = fd_getvnode(SCARG(uap, fd), &fp)) != 0)
return (error);
if ((fp->f_flag & FREAD) == 0) {
error = EBADF;
goto out;
}
error = vn_readdir(fp, SCARG(uap, buf), UIO_USERSPACE,
SCARG(uap, count), &done, l, 0, 0);
ktrgenio(SCARG(uap, fd), UIO_READ, SCARG(uap, buf), done, error);
*retval = done;
out:
fd_putfile(SCARG(uap, fd));
return (error);
}
/*
* Set the mode mask for creation of filesystem nodes.
*/
int
sys_umask(struct lwp *l, const struct sys_umask_args *uap, register_t *retval)
{
/* {
syscallarg(mode_t) newmask;
} */
/*
* cwdi->cwdi_cmask will be read unlocked elsewhere, and no kind of
* serialization with those reads is required. It's important to
* return a coherent answer for the caller of umask() though, and
* the atomic operation accomplishes that.
*/
*retval = atomic_swap_uint(&curproc->p_cwdi->cwdi_cmask,
SCARG(uap, newmask) & ALLPERMS);
return (0);
}
int
dorevoke(struct vnode *vp, kauth_cred_t cred)
{
struct vattr vattr;
int error, fs_decision;
/*
* Deallocate backing store for a file, creating a hole. Also used for
* invoking TRIM on disks.
*/
/* ARGSUSED */
int
sys_fdiscard(struct lwp *l, const struct sys_fdiscard_args *uap,
register_t *retval)
{
/* {
syscallarg(int) fd;
syscallarg(off_t) pos;
syscallarg(off_t) len;
} */
int fd;
off_t pos, len;
struct file *fp;
struct vnode *vp;
int error;
