2 * Copyright (c) 2004 The DragonFly Project. All rights reserved.
4 * This code is derived from software contributed to The DragonFly Project
5 * by Matthew Dillon <dillon@backplane.com>
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in
15 * the documentation and/or other materials provided with the
17 * 3. Neither the name of The DragonFly Project nor the names of its
18 * contributors may be used to endorse or promote products derived
19 * from this software without specific, prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
24 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
25 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26 * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
27 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
29 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
30 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
31 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 * nlookup() is the 'new' namei interface. Rather then return directory and
36 * leaf vnodes (in various lock states) the new interface instead deals in
37 * namecache records. Namecache records may represent both a positive or
38 * a negative hit. The namespace is locked via the namecache record instead
39 * of via the vnode, and only the leaf namecache record (representing the
40 * filename) needs to be locked.
42 * This greatly improves filesystem parallelism and is a huge simplification
43 * of the API verses the old vnode locking / namei scheme.
45 * Filesystems must actively control the caching aspects of the namecache,
46 * and since namecache pointers are used as handles they are non-optional
47 * even for filesystems which do not generally wish to cache things. It is
48 * intended that a separate cache coherency API will be constructed to handle
52 #include "opt_ktrace.h"
54 #include <sys/param.h>
55 #include <sys/systm.h>
56 #include <sys/kernel.h>
57 #include <sys/vnode.h>
58 #include <sys/mount.h>
59 #include <sys/filedesc.h>
61 #include <sys/namei.h>
62 #include <sys/nlookup.h>
63 #include <sys/malloc.h>
65 #include <sys/objcache.h>
69 #include <sys/ktrace.h>
72 static int naccess(struct nchandle
*nch
, int vmode
, struct ucred
*cred
,
76 * Initialize a nlookup() structure, early error return for copyin faults
77 * or a degenerate empty string (which is not allowed).
79 * The first process proc0's credentials are used if the calling thread
80 * is not associated with a process context.
85 nlookup_init(struct nlookupdata
*nd
,
86 const char *path
, enum uio_seg seg
, int flags
)
97 * note: the pathlen set by copy*str() includes the terminating \0.
99 bzero(nd
, sizeof(struct nlookupdata
));
100 nd
->nl_path
= objcache_get(namei_oc
, M_WAITOK
);
101 nd
->nl_flags
|= NLC_HASBUF
;
102 if (seg
== UIO_SYSSPACE
)
103 error
= copystr(path
, nd
->nl_path
, MAXPATHLEN
, &pathlen
);
105 error
= copyinstr(path
, nd
->nl_path
, MAXPATHLEN
, &pathlen
);
108 * Don't allow empty pathnames.
109 * POSIX.1 requirement: "" is not a vaild file name.
111 if (error
== 0 && pathlen
<= 1)
116 cache_copy(&p
->p_fd
->fd_ncdir
, &nd
->nl_nch
);
117 cache_copy(&p
->p_fd
->fd_nrdir
, &nd
->nl_rootnch
);
118 if (p
->p_fd
->fd_njdir
.ncp
)
119 cache_copy(&p
->p_fd
->fd_njdir
, &nd
->nl_jailnch
);
120 nd
->nl_cred
= crhold(p
->p_ucred
);
122 cache_copy(&rootnch
, &nd
->nl_nch
);
123 cache_copy(&nd
->nl_nch
, &nd
->nl_rootnch
);
124 cache_copy(&nd
->nl_nch
, &nd
->nl_jailnch
);
125 nd
->nl_cred
= crhold(proc0
.p_ucred
);
128 nd
->nl_flags
|= flags
;
137 * nlookup_init() for "at" family of syscalls.
139 * Works similarly to nlookup_init() but if path is relative and fd is not
140 * AT_FDCWD, path is interpreted relative to the directory pointed to by fd.
141 * In this case, the file entry pointed to by fd is ref'ed and returned in
144 * If the call succeeds, nlookup_done_at() must be called to clean-up the nd
145 * and release the ref to the file entry.
148 nlookup_init_at(struct nlookupdata
*nd
, struct file
**fpp
, int fd
,
149 const char *path
, enum uio_seg seg
, int flags
)
151 struct thread
*td
= curthread
;
152 struct proc
*p
= td
->td_proc
;
159 if ((error
= nlookup_init(nd
, path
, seg
, flags
)) != 0) {
163 if (nd
->nl_path
[0] != '/' && fd
!= AT_FDCWD
) {
164 if ((error
= holdvnode(p
->p_fd
, fd
, &fp
)) != 0)
166 vp
= (struct vnode
*)fp
->f_data
;
167 if (vp
->v_type
!= VDIR
|| fp
->f_nchandle
.ncp
== NULL
) {
173 cache_drop(&nd
->nl_nch
);
174 cache_copy(&fp
->f_nchandle
, &nd
->nl_nch
);
187 * This works similarly to nlookup_init() but does not assume a process
188 * context. rootnch is always chosen for the root directory and the cred
189 * and starting directory are supplied in arguments.
192 nlookup_init_raw(struct nlookupdata
*nd
,
193 const char *path
, enum uio_seg seg
, int flags
,
194 struct ucred
*cred
, struct nchandle
*ncstart
)
202 bzero(nd
, sizeof(struct nlookupdata
));
203 nd
->nl_path
= objcache_get(namei_oc
, M_WAITOK
);
204 nd
->nl_flags
|= NLC_HASBUF
;
205 if (seg
== UIO_SYSSPACE
)
206 error
= copystr(path
, nd
->nl_path
, MAXPATHLEN
, &pathlen
);
208 error
= copyinstr(path
, nd
->nl_path
, MAXPATHLEN
, &pathlen
);
211 * Don't allow empty pathnames.
212 * POSIX.1 requirement: "" is not a vaild file name.
214 if (error
== 0 && pathlen
<= 1)
218 cache_copy(ncstart
, &nd
->nl_nch
);
219 cache_copy(&rootnch
, &nd
->nl_rootnch
);
220 cache_copy(&rootnch
, &nd
->nl_jailnch
);
221 nd
->nl_cred
= crhold(cred
);
223 nd
->nl_flags
|= flags
;
231 * This works similarly to nlookup_init_raw() but does not rely
232 * on rootnch being initialized yet.
235 nlookup_init_root(struct nlookupdata
*nd
,
236 const char *path
, enum uio_seg seg
, int flags
,
237 struct ucred
*cred
, struct nchandle
*ncstart
,
238 struct nchandle
*ncroot
)
246 bzero(nd
, sizeof(struct nlookupdata
));
247 nd
->nl_path
= objcache_get(namei_oc
, M_WAITOK
);
248 nd
->nl_flags
|= NLC_HASBUF
;
249 if (seg
== UIO_SYSSPACE
)
250 error
= copystr(path
, nd
->nl_path
, MAXPATHLEN
, &pathlen
);
252 error
= copyinstr(path
, nd
->nl_path
, MAXPATHLEN
, &pathlen
);
255 * Don't allow empty pathnames.
256 * POSIX.1 requirement: "" is not a vaild file name.
258 if (error
== 0 && pathlen
<= 1)
262 cache_copy(ncstart
, &nd
->nl_nch
);
263 cache_copy(ncroot
, &nd
->nl_rootnch
);
264 cache_copy(ncroot
, &nd
->nl_jailnch
);
265 nd
->nl_cred
= crhold(cred
);
267 nd
->nl_flags
|= flags
;
275 * Set a different credential; this credential will be used by future
276 * operations performed on nd.nl_open_vp and nlookupdata structure.
279 nlookup_set_cred(struct nlookupdata
*nd
, struct ucred
*cred
)
281 KKASSERT(nd
->nl_cred
!= NULL
);
283 if (nd
->nl_cred
!= cred
) {
291 * Cleanup a nlookupdata structure after we are through with it. This may
292 * be called on any nlookupdata structure initialized with nlookup_init().
293 * Calling nlookup_done() is mandatory in all cases except where nlookup_init()
294 * returns an error, even if as a consumer you believe you have taken all
295 * dynamic elements out of the nlookupdata structure.
298 nlookup_done(struct nlookupdata
*nd
)
300 if (nd
->nl_nch
.ncp
) {
301 if (nd
->nl_flags
& NLC_NCPISLOCKED
) {
302 nd
->nl_flags
&= ~NLC_NCPISLOCKED
;
303 cache_unlock(&nd
->nl_nch
);
305 cache_drop(&nd
->nl_nch
); /* NULL's out the nch */
307 if (nd
->nl_rootnch
.ncp
)
308 cache_drop(&nd
->nl_rootnch
);
309 if (nd
->nl_jailnch
.ncp
)
310 cache_drop(&nd
->nl_jailnch
);
311 if ((nd
->nl_flags
& NLC_HASBUF
) && nd
->nl_path
) {
312 objcache_put(namei_oc
, nd
->nl_path
);
319 if (nd
->nl_open_vp
) {
320 if (nd
->nl_flags
& NLC_LOCKVP
) {
321 vn_unlock(nd
->nl_open_vp
);
322 nd
->nl_flags
&= ~NLC_LOCKVP
;
324 vn_close(nd
->nl_open_vp
, nd
->nl_vp_fmode
, NULL
);
325 nd
->nl_open_vp
= NULL
;
331 nd
->nl_flags
= 0; /* clear remaining flags (just clear everything) */
335 * Works similarly to nlookup_done() when nd initialized with
339 nlookup_done_at(struct nlookupdata
*nd
, struct file
*fp
)
347 nlookup_zero(struct nlookupdata
*nd
)
349 bzero(nd
, sizeof(struct nlookupdata
));
353 * Simple all-in-one nlookup. Returns a locked namecache structure or NULL
354 * if an error occured.
356 * Note that the returned ncp is not checked for permissions, though VEXEC
357 * is checked on the directory path leading up to the result. The caller
358 * must call naccess() to check the permissions of the returned leaf.
361 nlookup_simple(const char *str
, enum uio_seg seg
,
362 int niflags
, int *error
)
364 struct nlookupdata nd
;
367 *error
= nlookup_init(&nd
, str
, seg
, niflags
);
369 if ((*error
= nlookup(&nd
)) == 0) {
370 nch
= nd
.nl_nch
; /* keep hold ref from structure */
371 cache_zero(&nd
.nl_nch
); /* and NULL out */
383 * Returns non-zero if the path element is the last element
387 islastelement(const char *ptr
)
395 * Returns non-zero if we need to lock the namecache element
396 * exclusively. Unless otherwise requested by NLC_SHAREDLOCK,
397 * the last element of the namecache lookup will be locked
400 * NOTE: Even if we return on-zero, an unresolved namecache record
401 * will always be locked exclusively.
405 wantsexcllock(struct nlookupdata
*nd
, const char *ptr
)
407 if ((nd
->nl_flags
& NLC_SHAREDLOCK
) == 0)
408 return(islastelement(ptr
));
414 * Do a generic nlookup. Note that the passed nd is not nlookup_done()'d
415 * on return, even if an error occurs. If no error occurs or NLC_CREATE
416 * is flagged and ENOENT is returned, then the returned nl_nch is always
417 * referenced and locked exclusively.
419 * WARNING: For any general error other than ENOENT w/NLC_CREATE, the
420 * the resulting nl_nch may or may not be locked and if locked
421 * might be locked either shared or exclusive.
423 * Intermediate directory elements, including the current directory, require
424 * execute (search) permission. nlookup does not examine the access
425 * permissions on the returned element.
427 * If NLC_CREATE is set the last directory must allow node creation,
428 * and an error code of 0 will be returned for a non-existant
429 * target (not ENOENT).
431 * If NLC_RENAME_DST is set the last directory mut allow node deletion,
432 * plus the sticky check is made, and an error code of 0 will be returned
433 * for a non-existant target (not ENOENT).
435 * If NLC_DELETE is set the last directory mut allow node deletion,
436 * plus the sticky check is made.
438 * If NLC_REFDVP is set nd->nl_dvp will be set to the directory vnode
439 * of the returned entry. The vnode will be referenced, but not locked,
440 * and will be released by nlookup_done() along with everything else.
442 * NOTE: As an optimization we attempt to obtain a shared namecache lock
443 * on any intermediate elements. On success, the returned element
444 * is ALWAYS locked exclusively.
447 nlookup(struct nlookupdata
*nd
)
449 globaldata_t gd
= mycpu
;
450 struct nlcomponent nlc
;
453 struct nchandle nctmp
;
455 struct vnode
*hvp
; /* hold to prevent recyclement */
462 int saveflag
= nd
->nl_flags
;
463 boolean_t doretry
= FALSE
;
464 boolean_t inretry
= FALSE
;
468 if (KTRPOINT(nd
->nl_td
, KTR_NAMEI
))
469 ktrnamei(nd
->nl_td
->td_lwp
, nd
->nl_path
);
471 bzero(&nlc
, sizeof(nlc
));
474 * Setup for the loop. The current working namecache element is
475 * always at least referenced. We lock it as required, but always
476 * return a locked, resolved namecache entry.
486 * Loop on the path components. At the top of the loop nd->nl_nch
487 * is ref'd and unlocked and represents our current position.
491 * Make sure nl_nch is locked so we can access the vnode, resolution
494 if ((nd
->nl_flags
& NLC_NCPISLOCKED
) == 0) {
495 nd
->nl_flags
|= NLC_NCPISLOCKED
;
496 cache_lock_maybe_shared(&nd
->nl_nch
, wantsexcllock(nd
, ptr
));
500 * Check if the root directory should replace the current
501 * directory. This is done at the start of a translation
502 * or after a symbolic link has been found. In other cases
503 * ptr will never be pointing at a '/'.
508 } while (*ptr
== '/');
509 cache_unlock(&nd
->nl_nch
);
510 cache_get_maybe_shared(&nd
->nl_rootnch
, &nch
,
511 wantsexcllock(nd
, ptr
));
512 cache_drop(&nd
->nl_nch
);
513 nd
->nl_nch
= nch
; /* remains locked */
516 * Fast-track termination. There is no parent directory of
517 * the root in the same mount from the point of view of
518 * the caller so return EACCES if NLC_REFDVP is specified,
519 * and EEXIST if NLC_CREATE is also specified.
520 * e.g. 'rmdir /' or 'mkdir /' are not allowed.
523 if (nd
->nl_flags
& NLC_REFDVP
)
524 error
= (nd
->nl_flags
& NLC_CREATE
) ? EEXIST
: EACCES
;
533 * Check directory search permissions (nd->nl_nch is locked & refd)
536 error
= naccess(&nd
->nl_nch
, NLC_EXEC
, nd
->nl_cred
, &dflags
);
541 * Extract the path component. Path components are limited to
544 nlc
.nlc_nameptr
= ptr
;
545 while (*ptr
&& *ptr
!= '/')
547 nlc
.nlc_namelen
= ptr
- nlc
.nlc_nameptr
;
548 if (nlc
.nlc_namelen
>= 256) {
549 error
= ENAMETOOLONG
;
554 * Lookup the path component in the cache, creating an unresolved
555 * entry if necessary. We have to handle "." and ".." as special
558 * When handling ".." we have to detect a traversal back through a
559 * mount point. If we are at the root, ".." just returns the root.
561 * When handling "." or ".." we also have to recalculate dflags
562 * since our dflags will be for some sub-directory instead of the
565 * This subsection returns a locked, refd 'nch' unless it errors out,
566 * and an unlocked but still ref'd nd->nl_nch.
568 * The namecache topology is not allowed to be disconnected, so
569 * encountering a NULL parent will generate EINVAL. This typically
570 * occurs when a directory is removed out from under a process.
572 * WARNING! The unlocking of nd->nl_nch is sensitive code.
574 KKASSERT(nd
->nl_flags
& NLC_NCPISLOCKED
);
576 if (nlc
.nlc_namelen
== 1 && nlc
.nlc_nameptr
[0] == '.') {
577 cache_unlock(&nd
->nl_nch
);
578 nd
->nl_flags
&= ~NLC_NCPISLOCKED
;
579 cache_get_maybe_shared(&nd
->nl_nch
, &nch
, wantsexcllock(nd
, ptr
));
581 } else if (nlc
.nlc_namelen
== 2 &&
582 nlc
.nlc_nameptr
[0] == '.' && nlc
.nlc_nameptr
[1] == '.') {
583 if (nd
->nl_nch
.mount
== nd
->nl_rootnch
.mount
&&
584 nd
->nl_nch
.ncp
== nd
->nl_rootnch
.ncp
587 * ".." at the root returns the root
589 cache_unlock(&nd
->nl_nch
);
590 nd
->nl_flags
&= ~NLC_NCPISLOCKED
;
591 cache_get_maybe_shared(&nd
->nl_nch
, &nch
,
592 wantsexcllock(nd
, ptr
));
595 * Locate the parent ncp. If we are at the root of a
596 * filesystem mount we have to skip to the mounted-on
597 * point in the underlying filesystem.
599 * Expect the parent to always be good since the
600 * mountpoint doesn't go away. XXX hack. cache_get()
601 * requires the ncp to already have a ref as a safety.
603 * However, a process which has been broken out of a chroot
604 * will wind up with a NULL parent if it tries to '..' above
605 * the real root, deal with the case. Note that this does
606 * not protect us from a jail breakout, it just stops a panic
607 * if the jail-broken process tries to '..' past the real
611 while (nctmp
.ncp
== nctmp
.mount
->mnt_ncmountpt
.ncp
) {
612 nctmp
= nctmp
.mount
->mnt_ncmounton
;
613 if (nctmp
.ncp
== NULL
)
616 if (nctmp
.ncp
== NULL
) {
617 if (curthread
->td_proc
) {
618 kprintf("vfs_nlookup: '..' traverse broke "
619 "jail: pid %d (%s)\n",
620 curthread
->td_proc
->p_pid
,
623 nctmp
= nd
->nl_rootnch
;
625 nctmp
.ncp
= nctmp
.ncp
->nc_parent
;
628 cache_unlock(&nd
->nl_nch
);
629 nd
->nl_flags
&= ~NLC_NCPISLOCKED
;
630 cache_get_maybe_shared(&nctmp
, &nch
, wantsexcllock(nd
, ptr
));
631 cache_drop(&nctmp
); /* NOTE: zero's nctmp */
636 * Must unlock nl_nch when traversing down the path. However,
637 * the child ncp has not yet been found/created and the parent's
638 * child list might be empty. Thus releasing the lock can
639 * allow a race whereby the parent ncp's vnode is recycled.
640 * This case can occur especially when maxvnodes is set very low.
642 * We need the parent's ncp to remain resolved for all normal
643 * filesystem activities, so we vhold() the vp during the lookup
644 * to prevent recyclement due to vnlru / maxvnodes.
646 * If we race an unlink or rename the ncp might be marked
647 * DESTROYED after resolution, requiring a retry.
649 if ((hvp
= nd
->nl_nch
.ncp
->nc_vp
) != NULL
)
651 cache_unlock(&nd
->nl_nch
);
652 nd
->nl_flags
&= ~NLC_NCPISLOCKED
;
653 error
= cache_nlookup_maybe_shared(&nd
->nl_nch
, &nlc
,
654 wantsexcllock(nd
, ptr
), &nch
);
655 if (error
== EWOULDBLOCK
) {
656 nch
= cache_nlookup(&nd
->nl_nch
, &nlc
);
657 if (nch
.ncp
->nc_flag
& NCF_UNRESOLVED
)
660 error
= cache_resolve(&nch
, nd
->nl_cred
);
661 if (error
!= EAGAIN
&&
662 (nch
.ncp
->nc_flag
& NCF_DESTROYED
) == 0) {
663 if (error
== ESTALE
) {
670 kprintf("[diagnostic] nlookup: relookup %*.*s\n",
671 nch
.ncp
->nc_nlen
, nch
.ncp
->nc_nlen
,
674 nch
= cache_nlookup(&nd
->nl_nch
, &nlc
);
683 * If the last component was "." or ".." our dflags no longer
684 * represents the parent directory and we have to explicitly
687 * Expect the parent to be good since nch is locked.
689 if (wasdotordotdot
&& error
== 0) {
691 if ((par
.ncp
= nch
.ncp
->nc_parent
) != NULL
) {
692 par
.mount
= nch
.mount
;
694 cache_lock_maybe_shared(&par
, wantsexcllock(nd
, ptr
));
695 error
= naccess(&par
, 0, nd
->nl_cred
, &dflags
);
701 * [end of subsection]
703 * nch is locked and referenced.
704 * nd->nl_nch is unlocked and referenced.
706 * nl_nch must be unlocked or we could chain lock to the root
707 * if a resolve gets stuck (e.g. in NFS).
709 KKASSERT((nd
->nl_flags
& NLC_NCPISLOCKED
) == 0);
712 * Resolve the namespace if necessary. The ncp returned by
713 * cache_nlookup() is referenced and locked.
715 * XXX neither '.' nor '..' should return EAGAIN since they were
716 * previously resolved and thus cannot be newly created ncp's.
718 if (nch
.ncp
->nc_flag
& NCF_UNRESOLVED
) {
720 error
= cache_resolve(&nch
, nd
->nl_cred
);
721 if (error
== ESTALE
) {
726 KKASSERT(error
!= EAGAIN
);
728 error
= nch
.ncp
->nc_error
;
732 * Early completion. ENOENT is not an error if this is the last
733 * component and NLC_CREATE or NLC_RENAME (rename target) was
734 * requested. Note that ncp->nc_error is left as ENOENT in that
735 * case, which we check later on.
737 * Also handle invalid '.' or '..' components terminating a path
738 * for a create/rename/delete. The standard requires this and pax
739 * pretty stupidly depends on it.
741 if (islastelement(ptr
)) {
742 if (error
== ENOENT
&&
743 (nd
->nl_flags
& (NLC_CREATE
| NLC_RENAME_DST
))
745 if (nd
->nl_flags
& NLC_NFS_RDONLY
) {
748 error
= naccess(&nch
, nd
->nl_flags
| dflags
,
752 if (error
== 0 && wasdotordotdot
&&
753 (nd
->nl_flags
& (NLC_CREATE
| NLC_DELETE
|
754 NLC_RENAME_SRC
| NLC_RENAME_DST
))) {
758 if (nd
->nl_flags
& NLC_CREATE
)
760 else if (nd
->nl_flags
& NLC_DELETE
)
761 error
= (wasdotordotdot
== 1) ? EINVAL
: ENOTEMPTY
;
768 * Early completion on error.
776 * If the element is a symlink and it is either not the last
777 * element or it is the last element and we are allowed to
778 * follow symlinks, resolve the symlink.
780 if ((nch
.ncp
->nc_flag
& NCF_ISSYMLINK
) &&
781 (*ptr
|| (nd
->nl_flags
& NLC_FOLLOW
))
783 if (nd
->nl_loopcnt
++ >= MAXSYMLINKS
) {
788 error
= nreadsymlink(nd
, &nch
, &nlc
);
794 * Concatenate trailing path elements onto the returned symlink.
795 * Note that if the path component (ptr) is not exhausted, it
796 * will being with a '/', so we do not have to add another one.
798 * The symlink may not be empty.
801 if (nlc
.nlc_namelen
== 0 || nlc
.nlc_namelen
+ len
>= MAXPATHLEN
) {
802 error
= nlc
.nlc_namelen
? ENAMETOOLONG
: ENOENT
;
803 objcache_put(namei_oc
, nlc
.nlc_nameptr
);
806 bcopy(ptr
, nlc
.nlc_nameptr
+ nlc
.nlc_namelen
, len
+ 1);
807 if (nd
->nl_flags
& NLC_HASBUF
)
808 objcache_put(namei_oc
, nd
->nl_path
);
809 nd
->nl_path
= nlc
.nlc_nameptr
;
810 nd
->nl_flags
|= NLC_HASBUF
;
814 * Go back up to the top to resolve any initial '/'s in the
821 * If the element is a directory and we are crossing a mount point,
824 while ((nch
.ncp
->nc_flag
& NCF_ISMOUNTPT
) &&
825 (nd
->nl_flags
& NLC_NOCROSSMOUNT
) == 0 &&
826 (mp
= cache_findmount(&nch
)) != NULL
832 * VFS must be busied before the namecache entry is locked,
833 * but we don't want to waste time calling vfs_busy() if the
834 * mount point is already resolved.
839 while (vfs_busy(mp
, 0)) {
840 if (mp
->mnt_kern_flag
& MNTK_UNMOUNT
) {
841 kprintf("nlookup: warning umount race avoided\n");
849 cache_get_maybe_shared(&mp
->mnt_ncmountpt
, &nch
,
850 wantsexcllock(nd
, ptr
));
852 if (nch
.ncp
->nc_flag
& NCF_UNRESOLVED
) {
853 if (vfs_do_busy
== 0) {
857 error
= VFS_ROOT(mp
, &tdp
);
864 cache_setvp(&nch
, tdp
);
879 * Skip any slashes to get to the next element. If there
880 * are any slashes at all the current element must be a
881 * directory or, in the create case, intended to become a directory.
882 * If it isn't we break without incrementing ptr and fall through
883 * to the failure case below.
885 while (*ptr
== '/') {
886 if ((nch
.ncp
->nc_flag
& NCF_ISDIR
) == 0 &&
887 !(nd
->nl_flags
& NLC_WILLBEDIR
)
895 * Continuation case: additional elements and the current
896 * element is a directory.
898 if (*ptr
&& (nch
.ncp
->nc_flag
& NCF_ISDIR
)) {
899 cache_drop(&nd
->nl_nch
);
901 KKASSERT((nd
->nl_flags
& NLC_NCPISLOCKED
) == 0);
907 * Failure case: additional elements and the current element
917 * Successful lookup of last element.
919 * Check permissions if the target exists. If the target does not
920 * exist directory permissions were already tested in the early
921 * completion code above.
923 * nd->nl_flags will be adjusted on return with NLC_APPENDONLY
924 * if the file is marked append-only, and NLC_STICKY if the directory
925 * containing the file is sticky.
927 if (nch
.ncp
->nc_vp
&& (nd
->nl_flags
& NLC_ALLCHKS
)) {
928 error
= naccess(&nch
, nd
->nl_flags
| dflags
,
937 * Termination: no more elements.
939 * If NLC_REFDVP is set acquire a referenced parent dvp.
941 if (nd
->nl_flags
& NLC_REFDVP
) {
942 cache_lock(&nd
->nl_nch
);
943 error
= cache_vref(&nd
->nl_nch
, nd
->nl_cred
, &nd
->nl_dvp
);
944 cache_unlock(&nd
->nl_nch
);
946 kprintf("NLC_REFDVP: Cannot ref dvp of %p\n", nch
.ncp
);
951 cache_drop(&nd
->nl_nch
);
953 nd
->nl_flags
|= NLC_NCPISLOCKED
;
959 ++gd
->gd_nchstats
->ncs_longhits
;
961 ++gd
->gd_nchstats
->ncs_longmiss
;
963 if (nd
->nl_flags
& NLC_NCPISLOCKED
)
964 KKASSERT(cache_lockstatus(&nd
->nl_nch
) > 0);
967 * Retry the whole thing if doretry flag is set, but only once.
968 * autofs(5) may mount another filesystem under its root directory
969 * while resolving a path.
971 if (doretry
&& !inretry
) {
973 nd
->nl_flags
= saveflag
;
978 * NOTE: If NLC_CREATE was set the ncp may represent a negative hit
979 * (ncp->nc_error will be ENOENT), but we will still return an error
986 * Resolve a mount point's glue ncp. This ncp connects creates the illusion
987 * of continuity in the namecache tree by connecting the ncp related to the
988 * vnode under the mount to the ncp related to the mount's root vnode.
990 * If no error occured a locked, ref'd ncp is stored in *ncpp.
993 nlookup_mp(struct mount
*mp
, struct nchandle
*nch
)
999 cache_get(&mp
->mnt_ncmountpt
, nch
);
1000 if (nch
->ncp
->nc_flag
& NCF_UNRESOLVED
) {
1001 while (vfs_busy(mp
, 0))
1003 error
= VFS_ROOT(mp
, &vp
);
1008 cache_setvp(nch
, vp
);
1016 * Read the contents of a symlink, allocate a path buffer out of the
1017 * namei_oc and initialize the supplied nlcomponent with the result.
1019 * If an error occurs no buffer will be allocated or returned in the nlc.
1022 nreadsymlink(struct nlookupdata
*nd
, struct nchandle
*nch
,
1023 struct nlcomponent
*nlc
)
1032 nlc
->nlc_nameptr
= NULL
;
1033 nlc
->nlc_namelen
= 0;
1034 if (nch
->ncp
->nc_vp
== NULL
)
1036 if ((error
= cache_vget(nch
, nd
->nl_cred
, LK_SHARED
, &vp
)) != 0)
1038 cp
= objcache_get(namei_oc
, M_WAITOK
);
1040 aiov
.iov_len
= MAXPATHLEN
;
1041 auio
.uio_iov
= &aiov
;
1042 auio
.uio_iovcnt
= 1;
1043 auio
.uio_offset
= 0;
1044 auio
.uio_rw
= UIO_READ
;
1045 auio
.uio_segflg
= UIO_SYSSPACE
;
1046 auio
.uio_td
= nd
->nl_td
;
1047 auio
.uio_resid
= MAXPATHLEN
- 1;
1048 error
= VOP_READLINK(vp
, &auio
, nd
->nl_cred
);
1051 linklen
= MAXPATHLEN
- 1 - auio
.uio_resid
;
1052 if (varsym_enable
) {
1053 linklen
= varsymreplace(cp
, linklen
, MAXPATHLEN
- 1);
1055 error
= ENAMETOOLONG
;
1060 nlc
->nlc_nameptr
= cp
;
1061 nlc
->nlc_namelen
= linklen
;
1065 objcache_put(namei_oc
, cp
);
1071 * Check access [XXX cache vattr!] [XXX quota]
1073 * Generally check the NLC_* access bits. All specified bits must pass
1074 * for this function to return 0.
1076 * The file does not have to exist when checking NLC_CREATE or NLC_RENAME_DST
1077 * access, otherwise it must exist. No error is returned in this case.
1079 * The file must not exist if NLC_EXCL is specified.
1081 * Directory permissions in general are tested for NLC_CREATE if the file
1082 * does not exist, NLC_DELETE if the file does exist, and NLC_RENAME_DST
1083 * whether the file exists or not.
1085 * The directory sticky bit is tested for NLC_DELETE and NLC_RENAME_DST,
1086 * the latter is only tested if the target exists.
1088 * The passed ncp must be referenced and locked. If it is already resolved
1089 * it may be locked shared but otherwise should be locked exclusively.
1092 naccess(struct nchandle
*nch
, int nflags
, struct ucred
*cred
, int *nflagsp
)
1096 struct namecache
*ncp
;
1100 KKASSERT(cache_lockstatus(nch
) > 0);
1103 if (ncp
->nc_flag
& NCF_UNRESOLVED
) {
1104 cache_resolve(nch
, cred
);
1107 error
= ncp
->nc_error
;
1110 * Directory permissions checks. Silently ignore ENOENT if these
1111 * tests pass. It isn't an error.
1113 * We can safely resolve ncp->nc_parent because ncp is currently
1116 if (nflags
& (NLC_CREATE
| NLC_DELETE
| NLC_RENAME_SRC
| NLC_RENAME_DST
)) {
1117 if (((nflags
& NLC_CREATE
) && ncp
->nc_vp
== NULL
) ||
1118 ((nflags
& NLC_DELETE
) && ncp
->nc_vp
!= NULL
) ||
1119 ((nflags
& NLC_RENAME_SRC
) && ncp
->nc_vp
!= NULL
) ||
1120 (nflags
& NLC_RENAME_DST
)
1122 struct nchandle par
;
1124 if ((par
.ncp
= ncp
->nc_parent
) == NULL
) {
1125 if (error
!= EAGAIN
)
1127 } else if (error
== 0 || error
== ENOENT
) {
1128 par
.mount
= nch
->mount
;
1130 cache_lock_maybe_shared(&par
, 0);
1131 error
= naccess(&par
, NLC_WRITE
, cred
, NULL
);
1138 * NLC_EXCL check. Target file must not exist.
1140 if (error
== 0 && (nflags
& NLC_EXCL
) && ncp
->nc_vp
!= NULL
)
1144 * Get the vnode attributes so we can do the rest of our checks.
1146 * NOTE: We only call naccess_va() if the target exists.
1149 error
= cache_vget(nch
, cred
, LK_SHARED
, &vp
);
1150 if (error
== ENOENT
) {
1152 * Silently zero-out ENOENT if creating or renaming
1153 * (rename target). It isn't an error.
1155 if (nflags
& (NLC_CREATE
| NLC_RENAME_DST
))
1157 } else if (error
== 0) {
1159 * Get the vnode attributes and check for illegal O_TRUNC
1160 * requests and read-only mounts.
1162 * NOTE: You can still open devices on read-only mounts for
1165 * NOTE: creates/deletes/renames are handled by the NLC_WRITE
1166 * check on the parent directory above.
1168 * XXX cache the va in the namecache or in the vnode
1170 error
= VOP_GETATTR(vp
, &va
);
1171 if (error
== 0 && (nflags
& NLC_TRUNCATE
)) {
1172 switch(va
.va_type
) {
1187 if (error
== 0 && (nflags
& NLC_WRITE
) && vp
->v_mount
&&
1188 (vp
->v_mount
->mnt_flag
& MNT_RDONLY
)
1190 switch(va
.va_type
) {
1204 * Check permissions based on file attributes. The passed
1205 * flags (*nflagsp) are modified with feedback based on
1206 * special attributes and requirements.
1210 * Adjust the returned (*nflagsp) if non-NULL.
1213 if ((va
.va_mode
& VSVTX
) && va
.va_uid
!= cred
->cr_uid
)
1214 *nflagsp
|= NLC_STICKY
;
1215 if (va
.va_flags
& APPEND
)
1216 *nflagsp
|= NLC_APPENDONLY
;
1217 if (va
.va_flags
& IMMUTABLE
)
1218 *nflagsp
|= NLC_IMMUTABLE
;
1222 * Track swapcache management flags in the namecache.
1224 * Calculate the flags based on the current vattr info
1225 * and recalculate the inherited flags from the parent
1226 * (the original cache linkage may have occurred without
1227 * getattrs and thus have stale flags).
1230 if (va
.va_flags
& SF_NOCACHE
)
1231 cflags
|= NCF_SF_NOCACHE
;
1232 if (va
.va_flags
& UF_CACHE
)
1233 cflags
|= NCF_UF_CACHE
;
1234 if (ncp
->nc_parent
) {
1235 if (ncp
->nc_parent
->nc_flag
&
1236 (NCF_SF_NOCACHE
| NCF_SF_PNOCACHE
)) {
1237 cflags
|= NCF_SF_PNOCACHE
;
1239 if (ncp
->nc_parent
->nc_flag
&
1240 (NCF_UF_CACHE
| NCF_UF_PCACHE
)) {
1241 cflags
|= NCF_UF_PCACHE
;
1246 * We're not supposed to update nc_flag when holding a shared
1247 * lock, but we allow the case for certain flags. Note that
1248 * holding an exclusive lock allows updating nc_flag without
1249 * atomics. nc_flag is not allowe to be updated at all unless
1250 * a shared or exclusive lock is held.
1252 atomic_clear_short(&ncp
->nc_flag
,
1253 (NCF_SF_NOCACHE
| NCF_UF_CACHE
|
1254 NCF_SF_PNOCACHE
| NCF_UF_PCACHE
) & ~cflags
);
1255 atomic_set_short(&ncp
->nc_flag
, cflags
);
1258 * Process general access.
1260 error
= naccess_va(&va
, nflags
, cred
);
1268 * Check the requested access against the given vattr using cred.
1271 naccess_va(struct vattr
*va
, int nflags
, struct ucred
*cred
)
1277 * Test the immutable bit. Creations, deletions, renames (source
1278 * or destination) are not allowed. chown/chmod/other is also not
1279 * allowed but is handled by SETATTR. Hardlinks to the immutable
1282 * If the directory is set to immutable then creations, deletions,
1283 * renames (source or dest) and hardlinks to files within the directory
1284 * are not allowed, and regular files opened through the directory may
1285 * not be written to or truncated (unless a special device).
1287 * NOTE! New hardlinks to immutable files work but new hardlinks to
1288 * files, immutable or not, sitting inside an immutable directory are
1289 * not allowed. As always if the file is hardlinked via some other
1290 * path additional hardlinks may be possible even if the file is marked
1291 * immutable. The sysop needs to create a closure by checking the hard
1292 * link count. Once closure is achieved you are good, and security
1293 * scripts should check link counts anyway.
1295 * Writes and truncations are only allowed on special devices.
1297 if ((va
->va_flags
& IMMUTABLE
) || (nflags
& NLC_IMMUTABLE
)) {
1298 if ((nflags
& NLC_IMMUTABLE
) && (nflags
& NLC_HLINK
))
1300 if (nflags
& (NLC_CREATE
| NLC_DELETE
|
1301 NLC_RENAME_SRC
| NLC_RENAME_DST
)) {
1304 if (nflags
& (NLC_WRITE
| NLC_TRUNCATE
)) {
1305 switch(va
->va_type
) {
1319 * Test the no-unlink and append-only bits for opens, rename targets,
1320 * and deletions. These bits are not tested for creations or
1323 * Unlike FreeBSD we allow a file with APPEND set to be renamed.
1324 * If you do not wish this you must also set NOUNLINK.
1326 * If the governing directory is marked APPEND-only it implies
1327 * NOUNLINK for all entries in the directory.
1329 if (((va
->va_flags
& NOUNLINK
) || (nflags
& NLC_APPENDONLY
)) &&
1330 (nflags
& (NLC_DELETE
| NLC_RENAME_SRC
| NLC_RENAME_DST
))
1336 * A file marked append-only may not be deleted but can be renamed.
1338 if ((va
->va_flags
& APPEND
) &&
1339 (nflags
& (NLC_DELETE
| NLC_RENAME_DST
))
1345 * A file marked append-only which is opened for writing must also
1346 * be opened O_APPEND.
1348 if ((va
->va_flags
& APPEND
) && (nflags
& (NLC_OPEN
| NLC_TRUNCATE
))) {
1349 if (nflags
& NLC_TRUNCATE
)
1351 if ((nflags
& (NLC_OPEN
| NLC_WRITE
)) == (NLC_OPEN
| NLC_WRITE
)) {
1352 if ((nflags
& NLC_APPEND
) == 0)
1358 * root gets universal access
1360 if (cred
->cr_uid
== 0)
1364 * Check owner perms.
1366 * If NLC_OWN is set the owner of the file is allowed no matter when
1367 * the owner-mode bits say (utimes).
1370 if (nflags
& NLC_READ
)
1372 if (nflags
& NLC_WRITE
)
1374 if (nflags
& NLC_EXEC
)
1377 if (cred
->cr_uid
== va
->va_uid
) {
1378 if ((nflags
& NLC_OWN
) == 0) {
1379 if ((vmode
& va
->va_mode
) != vmode
)
1386 * If NLC_STICKY is set only the owner may delete or rename a file.
1387 * This bit is typically set on /tmp.
1389 * Note that the NLC_READ/WRITE/EXEC bits are not typically set in
1390 * the specific delete or rename case. For deletions and renames we
1391 * usually just care about directory permissions, not file permissions.
1393 if ((nflags
& NLC_STICKY
) &&
1394 (nflags
& (NLC_RENAME_SRC
| NLC_RENAME_DST
| NLC_DELETE
))) {
1402 for (i
= 0; i
< cred
->cr_ngroups
; ++i
) {
1403 if (va
->va_gid
== cred
->cr_groups
[i
]) {
1404 if ((vmode
& va
->va_mode
) != vmode
)
1414 if ((vmode
& va
->va_mode
) != vmode
)