/*-
* Copyright (c) 2012 The NetBSD Foundation, Inc.
* All rights reserved.
*
* This code is derived from software contributed to The NetBSD Foundation
* by Taylor R Campbell.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in the
* documentation and/or other materials provided with the distribution.
*
* THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
* ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
* TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
* BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
* INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
* CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
* POSSIBILITY OF SUCH DAMAGE.
*/
/*
* Generic rename abstraction.
*
* Rename is unbelievably hairy. Try to use this if you can --
* otherwise you are practically guaranteed to get it wrong.
*/
/*
* Sample copypasta for implementing VOP_RENAME via genfs_rename.
* Don't change this template without carefully considering whether
* every other file system that already uses it needs to change too.
* That way, once we have changed all the file systems to use it, we
* can easily replace mumblefs_rename by mumblefs_sane_rename and
* eliminate the insane API altogether.
*/
/*
* XXX Want a better equality test. `tcnp->cn_cred == cred'
* hoses p2k because puffs transmits the creds separately and
* allocates distinct but equivalent structures for them.
*/
KASSERT(kauth_cred_uidmatch(cred, tcnp->cn_cred));
/*
* Sanitize our world from the VFS insanity. Unlock the target
* directory and node, which are locked. Release the children,
* which are referenced, since we'll be looking them up again
* later.
*/
VOP_UNLOCK(tdvp);
if ((tvp != NULL) && (tvp != tdvp))
VOP_UNLOCK(tvp);
/*
* All done, whether with success or failure. Release the
* directory nodes now, as the caller expects from the VFS
* protocol.
*/
vrele(fdvp);
vrele(tdvp);
return error;
}
/*
* genfs_sane_rename: Generic implementation of the saner API for the
* rename vop. Handles ancestry checks, locking, and permissions
* checks. Caller is responsible for implementing the genfs rename
* operations.
*
* fdvp and tdvp must be referenced and unlocked.
*/
int
genfs_sane_rename(const struct genfs_rename_ops *ops,
struct vnode *fdvp, struct componentname *fcnp, void *fde,
struct vnode *tdvp, struct componentname *tcnp, void *tde,
kauth_cred_t cred, bool posixly_correct)
{
struct mount *mp;
struct vnode *fvp = NULL, *tvp = NULL;
nlink_t tvp_new_nlink = 0;
int error;
mp = fdvp->v_mount;
KASSERT(mp != NULL);
KASSERT(mp == tdvp->v_mount);
/* XXX How can we be sure this stays true? */
KASSERT((mp->mnt_flag & MNT_RDONLY) == 0);
/*
* Check that everything is locked and looks right.
*/
KASSERT(fvp != NULL);
KASSERT(VOP_ISLOCKED(fdvp) == LK_EXCLUSIVE);
KASSERT(VOP_ISLOCKED(fvp) == LK_EXCLUSIVE);
KASSERT(VOP_ISLOCKED(tdvp) == LK_EXCLUSIVE);
KASSERT((tvp == NULL) || (VOP_ISLOCKED(tvp) == LK_EXCLUSIVE));
/*
* If the source and destination are the same object, we need
* only at most delete the source entry. We are guaranteed at
* this point that the entries are distinct.
*/
if (fvp == tvp) {
KASSERT(tvp != NULL);
if (fvp->v_type == VDIR)
/* XXX This shouldn't be possible. */
error = EINVAL;
else if (posixly_correct)
/* POSIX sez to leave them alone. */
error = 0;
else if ((fdvp == tdvp) &&
(fcnp->cn_namelen == tcnp->cn_namelen) &&
(memcmp(fcnp->cn_nameptr, tcnp->cn_nameptr,
fcnp->cn_namelen) == 0))
/* Renaming an entry over itself does nothing. */
error = 0;
else {
/* XXX Can't use VOP_REMOVE because of locking. */
error = genfs_rename_remove(ops, mp, cred,
fdvp, fcnp, fde, fvp, &tvp_new_nlink);
VN_KNOTE(fdvp, NOTE_WRITE);
VN_KNOTE(fvp,
tvp_new_nlink == 0 ? NOTE_DELETE : NOTE_LINK);
}
goto out;
}
KASSERT(fvp != tvp);
KASSERT((fdvp != tdvp) ||
(fcnp->cn_namelen != tcnp->cn_namelen) ||
(memcmp(fcnp->cn_nameptr, tcnp->cn_nameptr, fcnp->cn_namelen)
!= 0));
/*
* If the target exists, refuse to rename a directory over a
* non-directory or vice versa, or to clobber a non-empty
* directory.
*/
if (tvp != NULL) {
if (fvp->v_type == VDIR && tvp->v_type == VDIR)
error =
(ops->gro_directory_empty_p(mp, cred, tvp, tdvp)?
0 : ENOTEMPTY);
else if (fvp->v_type == VDIR && tvp->v_type != VDIR)
error = ENOTDIR;
else if (fvp->v_type != VDIR && tvp->v_type == VDIR)
error = EISDIR;
else
error = 0;
if (error)
goto out;
KASSERT((fvp->v_type == VDIR) == (tvp->v_type == VDIR));
}
/*
* genfs_rename_knote: Note events about the various vnodes in a
* rename. To be called by gro_rename on success. The only pair of
* vnodes that may be identical is {fdvp, tdvp}. tvp_new_nlink is
* the resulting link count of tvp.
*/
void
genfs_rename_knote(struct vnode *fdvp, struct vnode *fvp,
struct vnode *tdvp, struct vnode *tvp, nlink_t tvp_new_nlink)
{
long fdvp_events, tdvp_events;
bool directory_p, reparent_p, replaced_p;
/*
* genfs_rename_cache_purge: Purge the name cache. To be called by
* gro_rename on success. The only pair of vnodes that may be
* identical is {fdvp, tdvp}.
*/
void
genfs_rename_cache_purge(struct vnode *fdvp, struct vnode *fvp,
struct vnode *tdvp, struct vnode *tvp)
{
if ((tvp != NULL) && (tvp->v_type == VDIR))
cache_purge(tvp);
}
/*
* genfs_rename_enter: Look up fcnp in fdvp, and store the lookup
* results in *fde_ret and the associated vnode in *fvp_ret; fail if
* not found. Look up tcnp in tdvp, and store the lookup results in
* *tde_ret and the associated vnode in *tvp_ret; store null instead if
* not found. Fail if anything has been mounted on any of the nodes
* involved.
*
* fdvp and tdvp must be referenced.
*
* On entry, nothing is locked.
*
* On success, everything is locked, and *fvp_ret, and *tvp_ret if
* nonnull, are referenced. The only pairs of vnodes that may be
* identical are {fdvp, tdvp} and {fvp, tvp}.
*
* On failure, everything remains as was.
*
* Locking everything including the source and target nodes is
* necessary to make sure that, e.g., link count updates are OK. The
* locking order is, in general, ancestor-first, matching the order you
* need to use to look up a descendant anyway.
*/
static int
genfs_rename_enter(const struct genfs_rename_ops *ops,
struct mount *mp, kauth_cred_t cred,
struct vnode *fdvp, struct componentname *fcnp,
void *fde_ret, struct vnode **fvp_ret,
struct vnode *tdvp, struct componentname *tcnp,
void *tde_ret, struct vnode **tvp_ret)
{
int error;
out: if (intermediate_node != NULL)
vrele(intermediate_node);
return error;
}
/*
* genfs_rename_lock: Lookup and lock it all. The lock order is:
*
* a_dvp -> a_vp -> b_dvp -> b_vp,
*
* except if a_vp is a nondirectory in which case the lock order is:
*
* a_dvp -> b_dvp -> b_vp -> a_vp,
*
* which can't violate ancestor->descendant because a_vp has no
* descendants in this case. This edge case is necessary because some
* file systems can only lookup/lock/unlock, and we can't hold a_vp
* locked when we lookup/lock/unlock b_vp if they turn out to be the
* same, and we can't find out that they're the same until after the
* lookup.
*
* b_dvp must not be an ancestor of a_dvp, although a_dvp may be an
* ancestor of b_dvp.
*
* Fail with overlap_error if node a is directory b. Neither
* componentname may be `.' or `..'.
*
* a_dvp and b_dvp must be referenced.
*
* On entry, a_dvp and b_dvp are unlocked.
*
* On success,
* . a_dvp and b_dvp are locked,
* . *a_dirent_ret is filled with a directory entry whose node is
* locked and referenced,
* . *b_vp_ret is filled with the corresponding vnode,
* . *b_dirent_ret is filled either with null or with a directory entry
* whose node is locked and referenced,
* . *b_vp is filled either with null or with the corresponding vnode,
* and
* . the only pair of vnodes that may be identical is a_vp and b_vp.
*
* On failure, a_dvp and b_dvp are left unlocked, and *a_dirent_ret,
* *a_vp, *b_dirent_ret, and *b_vp are left alone.
*/
static int
genfs_rename_lock(const struct genfs_rename_ops *ops,
struct mount *mp, kauth_cred_t cred,
int overlap_error, int a_dot_error, int b_dot_error,
struct vnode *a_dvp, struct componentname *a_cnp, bool a_missing_ok,
void *a_de_ret, struct vnode **a_vp_ret,
struct vnode *b_dvp, struct componentname *b_cnp, bool b_missing_ok,
void *b_de_ret, struct vnode **b_vp_ret)
{
struct vnode *a_vp, *b_vp;
int error;
/* Refuse to rename (over) `.'. */
if (a_vp == a_dvp) {
error = a_dot_error;
goto fail2;
}
/* Reject rename("x", "x/y") or rename("x/y", "x"). */
if (a_vp == b_dvp) {
error = overlap_error;
goto fail2;
}
}
KASSERT(a_vp != a_dvp);
KASSERT(a_vp != b_dvp);
/*
* 3. Lock a_vp, if it is a directory.
*
* We already ruled out a_vp == a_dvp (i.e., a_cnp is `.'), so
* this is not locking against self, and we already ruled out
* a_vp == b_dvp, so this won't cause subsequent locking of
* b_dvp to lock against self.
*
* If a_vp is a nondirectory, we can't hold it when we lookup
* b_vp in case (a) the file system can only lookup/lock/unlock
* and (b) b_vp turns out to be the same file as a_vp due to
* hard links -- and we can't even detect that case until after
* we've looked up b_vp. Fortunately, if a_vp is a
* nondirectory, then it is a leaf, so we can safely lock it
* last.
*/
if (a_vp != NULL && a_vp->v_type == VDIR) {
vn_lock(a_vp, LK_EXCLUSIVE | LK_RETRY);
KASSERT(a_vp->v_mount == mp);
/* Refuse to rename (over) a mount point. */
if (a_vp->v_mountedhere != NULL) {
error = EBUSY;
goto fail3;
}
}
/* Refuse to rename (over) `.'. */
if (b_vp == b_dvp) {
error = b_dot_error;
goto fail5;
}
/*
* b_dvp must not be an ancestor of a_dvp, so if we
* find b_dvp/b_vp=a_dvp/a_vp something is wrong.
*/
if (b_vp == a_dvp) {
/*
* We have a directory hard link before us.
* XXX What error should this return? EDEADLK?
* Panic?
*/
error = EIO;
goto fail5;
}
}
KASSERT(b_vp != b_dvp);
KASSERT(b_vp != a_dvp);
/*
* 6. Lock a_vp, if it is a nondirectory.
*
* In this case a_vp is a leaf, so it is either equal to or
* incommensurate with b_vp, and so we can safely lock it at
* any point now.
*/
if (a_vp != NULL && a_vp->v_type != VDIR) {
vn_lock(a_vp, LK_EXCLUSIVE | LK_RETRY);
KASSERT(a_vp->v_mount == mp);
/* (not a directory so can't have anything mounted here) */
}
/*
* 7. Lock b_vp, if it is not a_vp.
*
* b_vp and a_vp may the same inode if they are hard links to
* one another.
*/
if ((b_vp != NULL) && (b_vp != a_vp)) {
vn_lock(b_vp, LK_EXCLUSIVE | LK_RETRY);
KASSERT(b_vp->v_mount == mp);
/* Refuse to rename (over) a mount point. */
if ((b_vp->v_type == VDIR) && (b_vp->v_mountedhere != NULL)) {
error = EBUSY;
goto fail6;
}
}
fail6: if ((b_vp != NULL) && (b_vp != a_vp))
VOP_UNLOCK(b_vp);
if (a_vp != NULL && a_vp->v_type != VDIR)
VOP_UNLOCK(a_vp);
fail5: if (b_vp != NULL)
vrele(b_vp);
fail4: VOP_UNLOCK(b_dvp);
fail3: if (a_vp != NULL && a_vp->v_type == VDIR)
VOP_UNLOCK(a_vp);
fail2: if (a_vp != NULL)
vrele(a_vp);
fail1: VOP_UNLOCK(a_dvp);
fail0: return error;
}
/*
* genfs_rename_exit: Unlock everything we locked for rename.
*
* fdvp and tdvp must be referenced.
*
* On entry, everything is locked, and fvp and tvp referenced.
*
* On exit, everything is unlocked, and fvp and tvp are released.
*/
static void
genfs_rename_exit(const struct genfs_rename_ops *ops,
struct mount *mp,
struct vnode *fdvp, struct vnode *fvp,
struct vnode *tdvp, struct vnode *tvp)
{
if ((tvp != NULL) && (tvp != fvp))
VOP_UNLOCK(tvp);
VOP_UNLOCK(fvp);
if (tvp != NULL)
vrele(tvp);
if (tdvp != fdvp)
VOP_UNLOCK(tdvp);
vrele(fvp);
VOP_UNLOCK(fdvp);
}
/*
* genfs_rename_remove: Remove the entry for the non-directory vp with
* componentname cnp from the directory dvp, using the lookup results
* de. It is the responsibility of gro_remove to purge the name cache.
*
* Everything must be locked and referenced.
*/
static int
genfs_rename_remove(const struct genfs_rename_ops *ops,
struct mount *mp, kauth_cred_t cred,
struct vnode *dvp, struct componentname *cnp, void *de, struct vnode *vp,
nlink_t *tvp_nlinkp)
{
int error;
error = ops->gro_remove(mp, cred, dvp, cnp, de, vp, tvp_nlinkp);
if (error)
return error;
return 0;
}
static int
genfs_ufslike_check_sticky(kauth_cred_t, mode_t, uid_t, struct vnode *, uid_t);
/*
* genfs_ufslike_rename_check_possible: Check whether a rename is
* possible independent of credentials, assuming UFS-like inode flag
* semantics. clobber_p is true iff the target node already exists.
*/
int
genfs_ufslike_rename_check_possible(
unsigned long fdflags, unsigned long fflags,
unsigned long tdflags, unsigned long tflags, bool clobber_p,
unsigned long immutable, unsigned long append)
{
if ((fdflags | fflags) & (immutable | append))
return EPERM;
if (clobber_p && (tflags & (immutable | append)))
return EPERM;
return 0;
}
/*
* genfs_ufslike_rename_check_permitted: Check whether a rename is
* permitted given our credentials, assuming UFS-like permission and
* ownership semantics.
*
* The only pair of vnodes that may be identical is {fdvp, tdvp}.
*
* Everything must be locked and referenced.
*/
int
genfs_ufslike_rename_check_permitted(kauth_cred_t cred,
struct vnode *fdvp, mode_t fdmode, uid_t fduid,
struct vnode *fvp, uid_t fuid,
struct vnode *tdvp, mode_t tdmode, uid_t tduid,
struct vnode *tvp, uid_t tuid)
{
int error;
/*
* We need to remove or change an entry in the source directory.
*/
error = VOP_ACCESS(fdvp, VWRITE, cred);
if (error)
return error;
/*
* If we are changing directories, then we need to write to the
* target directory to add or change an entry. Also, if fvp is
* a directory, we need to write to it to change its `..'
* entry.
*/
if (fdvp != tdvp) {
error = VOP_ACCESS(tdvp, VWRITE, cred);
if (error)
return error;
if (fvp->v_type == VDIR) {
error = VOP_ACCESS(fvp, VWRITE, cred);
if (error)
return error;
}
}
/*
* genfs_ufslike_remove_check_possible: Check whether a remove is
* possible independent of credentials, assuming UFS-like inode flag
* semantics.
*/
int
genfs_ufslike_remove_check_possible(unsigned long dflags, unsigned long flags,
unsigned long immutable, unsigned long append)
{
/*
* We want to delete the entry. If the directory is immutable,
* we can't write to it to delete the entry. If the directory
* is append-only, the only change we can make is to add
* entries, so we can't delete entries. If the node is
* immutable, we can't change the links to it, so we can't
* delete the entry. If the node is append-only...well, this
* is what UFS does.
*/
if ((dflags | flags) & (immutable | append))
return EPERM;
return 0;
}
/*
* genfs_ufslike_remove_check_permitted: Check whether a remove is
* permitted given our credentials, assuming UFS-like permission and
* ownership semantics.
*
* Everything must be locked and referenced.
*/
int
genfs_ufslike_remove_check_permitted(kauth_cred_t cred,
struct vnode *dvp, mode_t dmode, uid_t duid,
struct vnode *vp, uid_t uid)
{
int error;
/*
* genfs_ufslike_check_sticky: Check whether a party with credentials
* cred may change an entry in a sticky directory, assuming UFS-like
* permission, ownership, and stickiness semantics: If the directory is
* sticky and the entry exists, the user must own either the directory
* or the entry's node in order to change the entry.
*
* Everything must be locked and referenced.
*/
int
genfs_ufslike_check_sticky(kauth_cred_t cred, mode_t dmode, uid_t duid,
struct vnode *vp, uid_t uid)
{
