2 * Copyright (c) 2004 The DragonFly Project. All rights reserved.
4 * This code is derived from software contributed to The DragonFly Project
5 * by Matthew Dillon <dillon@backplane.com>
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in
15 * the documentation and/or other materials provided with the
17 * 3. Neither the name of The DragonFly Project nor the names of its
18 * contributors may be used to endorse or promote products derived
19 * from this software without specific, prior written permission.
21 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
24 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
25 * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26 * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
27 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
29 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
30 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
31 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35 * nlookup() is the 'new' namei interface. Rather then return directory and
36 * leaf vnodes (in various lock states) the new interface instead deals in
37 * namecache records. Namecache records may represent both a positive or
38 * a negative hit. The namespace is locked via the namecache record instead
39 * of via the vnode, and only the leaf namecache record (representing the
40 * filename) needs to be locked.
42 * This greatly improves filesystem parallelism and is a huge simplification
43 * of the API verses the old vnode locking / namei scheme.
45 * Filesystems must actively control the caching aspects of the namecache,
46 * and since namecache pointers are used as handles they are non-optional
47 * even for filesystems which do not generally wish to cache things. It is
48 * intended that a separate cache coherency API will be constructed to handle
52 #include "opt_ktrace.h"
54 #include <sys/param.h>
55 #include <sys/systm.h>
56 #include <sys/kernel.h>
57 #include <sys/vnode.h>
58 #include <sys/mount.h>
59 #include <sys/filedesc.h>
61 #include <sys/namei.h>
62 #include <sys/nlookup.h>
63 #include <sys/malloc.h>
65 #include <sys/objcache.h>
69 #include <sys/ktrace.h>
72 static int naccess(struct nchandle
*nch
, int vmode
, struct ucred
*cred
,
76 * Initialize a nlookup() structure, early error return for copyin faults
77 * or a degenerate empty string (which is not allowed).
79 * The first process proc0's credentials are used if the calling thread
80 * is not associated with a process context.
85 nlookup_init(struct nlookupdata
*nd
,
86 const char *path
, enum uio_seg seg
, int flags
)
97 * note: the pathlen set by copy*str() includes the terminating \0.
99 bzero(nd
, sizeof(struct nlookupdata
));
100 nd
->nl_path
= objcache_get(namei_oc
, M_WAITOK
);
101 nd
->nl_flags
|= NLC_HASBUF
;
102 if (seg
== UIO_SYSSPACE
)
103 error
= copystr(path
, nd
->nl_path
, MAXPATHLEN
, &pathlen
);
105 error
= copyinstr(path
, nd
->nl_path
, MAXPATHLEN
, &pathlen
);
108 * Don't allow empty pathnames.
109 * POSIX.1 requirement: "" is not a vaild file name.
111 if (error
== 0 && pathlen
<= 1)
116 cache_copy(&p
->p_fd
->fd_ncdir
, &nd
->nl_nch
);
117 cache_copy(&p
->p_fd
->fd_nrdir
, &nd
->nl_rootnch
);
118 if (p
->p_fd
->fd_njdir
.ncp
)
119 cache_copy(&p
->p_fd
->fd_njdir
, &nd
->nl_jailnch
);
120 nd
->nl_cred
= crhold(p
->p_ucred
);
122 cache_copy(&rootnch
, &nd
->nl_nch
);
123 cache_copy(&nd
->nl_nch
, &nd
->nl_rootnch
);
124 cache_copy(&nd
->nl_nch
, &nd
->nl_jailnch
);
125 nd
->nl_cred
= crhold(proc0
.p_ucred
);
128 nd
->nl_flags
|= flags
;
137 * nlookup_init() for "at" family of syscalls.
139 * Works similarly to nlookup_init() but if path is relative and fd is not
140 * AT_FDCWD, path is interpreted relative to the directory pointed to by fd.
141 * In this case, the file entry pointed to by fd is ref'ed and returned in
144 * If the call succeeds, nlookup_done_at() must be called to clean-up the nd
145 * and release the ref to the file entry.
148 nlookup_init_at(struct nlookupdata
*nd
, struct file
**fpp
, int fd
,
149 const char *path
, enum uio_seg seg
, int flags
)
151 struct thread
*td
= curthread
;
152 struct proc
*p
= td
->td_proc
;
159 if ((error
= nlookup_init(nd
, path
, seg
, flags
)) != 0) {
163 if (nd
->nl_path
[0] != '/' && fd
!= AT_FDCWD
) {
164 if ((error
= holdvnode(p
->p_fd
, fd
, &fp
)) != 0)
166 vp
= (struct vnode
*)fp
->f_data
;
167 if (vp
->v_type
!= VDIR
|| fp
->f_nchandle
.ncp
== NULL
) {
173 cache_drop(&nd
->nl_nch
);
174 cache_copy(&fp
->f_nchandle
, &nd
->nl_nch
);
187 * This works similarly to nlookup_init() but does not assume a process
188 * context. rootnch is always chosen for the root directory and the cred
189 * and starting directory are supplied in arguments.
192 nlookup_init_raw(struct nlookupdata
*nd
,
193 const char *path
, enum uio_seg seg
, int flags
,
194 struct ucred
*cred
, struct nchandle
*ncstart
)
202 bzero(nd
, sizeof(struct nlookupdata
));
203 nd
->nl_path
= objcache_get(namei_oc
, M_WAITOK
);
204 nd
->nl_flags
|= NLC_HASBUF
;
205 if (seg
== UIO_SYSSPACE
)
206 error
= copystr(path
, nd
->nl_path
, MAXPATHLEN
, &pathlen
);
208 error
= copyinstr(path
, nd
->nl_path
, MAXPATHLEN
, &pathlen
);
211 * Don't allow empty pathnames.
212 * POSIX.1 requirement: "" is not a vaild file name.
214 if (error
== 0 && pathlen
<= 1)
218 cache_copy(ncstart
, &nd
->nl_nch
);
219 cache_copy(&rootnch
, &nd
->nl_rootnch
);
220 cache_copy(&rootnch
, &nd
->nl_jailnch
);
221 nd
->nl_cred
= crhold(cred
);
223 nd
->nl_flags
|= flags
;
231 * This works similarly to nlookup_init_raw() but does not rely
232 * on rootnch being initialized yet.
235 nlookup_init_root(struct nlookupdata
*nd
,
236 const char *path
, enum uio_seg seg
, int flags
,
237 struct ucred
*cred
, struct nchandle
*ncstart
,
238 struct nchandle
*ncroot
)
246 bzero(nd
, sizeof(struct nlookupdata
));
247 nd
->nl_path
= objcache_get(namei_oc
, M_WAITOK
);
248 nd
->nl_flags
|= NLC_HASBUF
;
249 if (seg
== UIO_SYSSPACE
)
250 error
= copystr(path
, nd
->nl_path
, MAXPATHLEN
, &pathlen
);
252 error
= copyinstr(path
, nd
->nl_path
, MAXPATHLEN
, &pathlen
);
255 * Don't allow empty pathnames.
256 * POSIX.1 requirement: "" is not a vaild file name.
258 if (error
== 0 && pathlen
<= 1)
262 cache_copy(ncstart
, &nd
->nl_nch
);
263 cache_copy(ncroot
, &nd
->nl_rootnch
);
264 cache_copy(ncroot
, &nd
->nl_jailnch
);
265 nd
->nl_cred
= crhold(cred
);
267 nd
->nl_flags
|= flags
;
275 * Set a different credential; this credential will be used by future
276 * operations performed on nd.nl_open_vp and nlookupdata structure.
279 nlookup_set_cred(struct nlookupdata
*nd
, struct ucred
*cred
)
281 KKASSERT(nd
->nl_cred
!= NULL
);
283 if (nd
->nl_cred
!= cred
) {
291 * Cleanup a nlookupdata structure after we are through with it. This may
292 * be called on any nlookupdata structure initialized with nlookup_init().
293 * Calling nlookup_done() is mandatory in all cases except where nlookup_init()
294 * returns an error, even if as a consumer you believe you have taken all
295 * dynamic elements out of the nlookupdata structure.
298 nlookup_done(struct nlookupdata
*nd
)
300 if (nd
->nl_nch
.ncp
) {
301 if (nd
->nl_flags
& NLC_NCPISLOCKED
) {
302 nd
->nl_flags
&= ~NLC_NCPISLOCKED
;
303 cache_unlock(&nd
->nl_nch
);
305 cache_drop(&nd
->nl_nch
); /* NULL's out the nch */
307 if (nd
->nl_rootnch
.ncp
)
308 cache_drop(&nd
->nl_rootnch
);
309 if (nd
->nl_jailnch
.ncp
)
310 cache_drop(&nd
->nl_jailnch
);
311 if ((nd
->nl_flags
& NLC_HASBUF
) && nd
->nl_path
) {
312 objcache_put(namei_oc
, nd
->nl_path
);
319 if (nd
->nl_open_vp
) {
320 if (nd
->nl_flags
& NLC_LOCKVP
) {
321 vn_unlock(nd
->nl_open_vp
);
322 nd
->nl_flags
&= ~NLC_LOCKVP
;
324 vn_close(nd
->nl_open_vp
, nd
->nl_vp_fmode
, NULL
);
325 nd
->nl_open_vp
= NULL
;
331 nd
->nl_flags
= 0; /* clear remaining flags (just clear everything) */
335 * Works similarly to nlookup_done() when nd initialized with
339 nlookup_done_at(struct nlookupdata
*nd
, struct file
*fp
)
347 nlookup_zero(struct nlookupdata
*nd
)
349 bzero(nd
, sizeof(struct nlookupdata
));
353 * Simple all-in-one nlookup. Returns a locked namecache structure or NULL
354 * if an error occured.
356 * Note that the returned ncp is not checked for permissions, though VEXEC
357 * is checked on the directory path leading up to the result. The caller
358 * must call naccess() to check the permissions of the returned leaf.
361 nlookup_simple(const char *str
, enum uio_seg seg
,
362 int niflags
, int *error
)
364 struct nlookupdata nd
;
367 *error
= nlookup_init(&nd
, str
, seg
, niflags
);
369 if ((*error
= nlookup(&nd
)) == 0) {
370 nch
= nd
.nl_nch
; /* keep hold ref from structure */
371 cache_zero(&nd
.nl_nch
); /* and NULL out */
383 * Returns non-zero if the path element is the last element
387 islastelement(const char *ptr
)
395 * Returns non-zero if we need to lock the namecache element
396 * exclusively. Unless otherwise requested by NLC_SHAREDLOCK,
397 * the last element of the namecache lookup will be locked
400 * NOTE: Even if we return on-zero, an unresolved namecache record
401 * will always be locked exclusively.
405 wantsexcllock(struct nlookupdata
*nd
, const char *ptr
)
407 if ((nd
->nl_flags
& NLC_SHAREDLOCK
) == 0)
408 return(islastelement(ptr
));
414 * Do a generic nlookup. Note that the passed nd is not nlookup_done()'d
415 * on return, even if an error occurs. If no error occurs or NLC_CREATE
416 * is flagged and ENOENT is returned, then the returned nl_nch is always
417 * referenced and locked exclusively.
419 * WARNING: For any general error other than ENOENT w/NLC_CREATE, the
420 * the resulting nl_nch may or may not be locked and if locked
421 * might be locked either shared or exclusive.
423 * Intermediate directory elements, including the current directory, require
424 * execute (search) permission. nlookup does not examine the access
425 * permissions on the returned element.
427 * If NLC_CREATE is set the last directory must allow node creation,
428 * and an error code of 0 will be returned for a non-existant
429 * target (not ENOENT).
431 * If NLC_RENAME_DST is set the last directory mut allow node deletion,
432 * plus the sticky check is made, and an error code of 0 will be returned
433 * for a non-existant target (not ENOENT).
435 * If NLC_DELETE is set the last directory mut allow node deletion,
436 * plus the sticky check is made.
438 * If NLC_REFDVP is set nd->nl_dvp will be set to the directory vnode
439 * of the returned entry. The vnode will be referenced, but not locked,
440 * and will be released by nlookup_done() along with everything else.
442 * NOTE: As an optimization we attempt to obtain a shared namecache lock
443 * on any intermediate elements. On success, the returned element
444 * is ALWAYS locked exclusively.
447 nlookup(struct nlookupdata
*nd
)
449 globaldata_t gd
= mycpu
;
450 struct nlcomponent nlc
;
453 struct nchandle nctmp
;
455 struct vnode
*hvp
; /* hold to prevent recyclement */
464 if (KTRPOINT(nd
->nl_td
, KTR_NAMEI
))
465 ktrnamei(nd
->nl_td
->td_lwp
, nd
->nl_path
);
467 bzero(&nlc
, sizeof(nlc
));
470 * Setup for the loop. The current working namecache element is
471 * always at least referenced. We lock it as required, but always
472 * return a locked, resolved namecache entry.
482 * Loop on the path components. At the top of the loop nd->nl_nch
483 * is ref'd and unlocked and represents our current position.
487 * Make sure nl_nch is locked so we can access the vnode, resolution
490 if ((nd
->nl_flags
& NLC_NCPISLOCKED
) == 0) {
491 nd
->nl_flags
|= NLC_NCPISLOCKED
;
492 cache_lock_maybe_shared(&nd
->nl_nch
, wantsexcllock(nd
, ptr
));
496 * Check if the root directory should replace the current
497 * directory. This is done at the start of a translation
498 * or after a symbolic link has been found. In other cases
499 * ptr will never be pointing at a '/'.
504 } while (*ptr
== '/');
505 cache_unlock(&nd
->nl_nch
);
506 cache_get_maybe_shared(&nd
->nl_rootnch
, &nch
,
507 wantsexcllock(nd
, ptr
));
508 cache_drop(&nd
->nl_nch
);
509 nd
->nl_nch
= nch
; /* remains locked */
512 * Fast-track termination. There is no parent directory of
513 * the root in the same mount from the point of view of
514 * the caller so return EACCES if NLC_REFDVP is specified,
515 * and EEXIST if NLC_CREATE is also specified.
516 * e.g. 'rmdir /' or 'mkdir /' are not allowed.
519 if (nd
->nl_flags
& NLC_REFDVP
)
520 error
= (nd
->nl_flags
& NLC_CREATE
) ? EEXIST
: EACCES
;
529 * Check directory search permissions (nd->nl_nch is locked & refd)
532 error
= naccess(&nd
->nl_nch
, NLC_EXEC
, nd
->nl_cred
, &dflags
);
537 * Extract the path component. Path components are limited to
540 nlc
.nlc_nameptr
= ptr
;
541 while (*ptr
&& *ptr
!= '/')
543 nlc
.nlc_namelen
= ptr
- nlc
.nlc_nameptr
;
544 if (nlc
.nlc_namelen
>= 256) {
545 error
= ENAMETOOLONG
;
550 * Lookup the path component in the cache, creating an unresolved
551 * entry if necessary. We have to handle "." and ".." as special
554 * When handling ".." we have to detect a traversal back through a
555 * mount point. If we are at the root, ".." just returns the root.
557 * When handling "." or ".." we also have to recalculate dflags
558 * since our dflags will be for some sub-directory instead of the
561 * This subsection returns a locked, refd 'nch' unless it errors out,
562 * and an unlocked but still ref'd nd->nl_nch.
564 * The namecache topology is not allowed to be disconnected, so
565 * encountering a NULL parent will generate EINVAL. This typically
566 * occurs when a directory is removed out from under a process.
568 * WARNING! The unlocking of nd->nl_nch is sensitive code.
570 KKASSERT(nd
->nl_flags
& NLC_NCPISLOCKED
);
572 if (nlc
.nlc_namelen
== 1 && nlc
.nlc_nameptr
[0] == '.') {
573 cache_unlock(&nd
->nl_nch
);
574 nd
->nl_flags
&= ~NLC_NCPISLOCKED
;
575 cache_get_maybe_shared(&nd
->nl_nch
, &nch
, wantsexcllock(nd
, ptr
));
577 } else if (nlc
.nlc_namelen
== 2 &&
578 nlc
.nlc_nameptr
[0] == '.' && nlc
.nlc_nameptr
[1] == '.') {
579 if (nd
->nl_nch
.mount
== nd
->nl_rootnch
.mount
&&
580 nd
->nl_nch
.ncp
== nd
->nl_rootnch
.ncp
583 * ".." at the root returns the root
585 cache_unlock(&nd
->nl_nch
);
586 nd
->nl_flags
&= ~NLC_NCPISLOCKED
;
587 cache_get_maybe_shared(&nd
->nl_nch
, &nch
,
588 wantsexcllock(nd
, ptr
));
591 * Locate the parent ncp. If we are at the root of a
592 * filesystem mount we have to skip to the mounted-on
593 * point in the underlying filesystem.
595 * Expect the parent to always be good since the
596 * mountpoint doesn't go away. XXX hack. cache_get()
597 * requires the ncp to already have a ref as a safety.
599 * However, a process which has been broken out of a chroot
600 * will wind up with a NULL parent if it tries to '..' above
601 * the real root, deal with the case. Note that this does
602 * not protect us from a jail breakout, it just stops a panic
603 * if the jail-broken process tries to '..' past the real
607 while (nctmp
.ncp
== nctmp
.mount
->mnt_ncmountpt
.ncp
) {
608 nctmp
= nctmp
.mount
->mnt_ncmounton
;
609 if (nctmp
.ncp
== NULL
)
612 if (nctmp
.ncp
== NULL
) {
613 if (curthread
->td_proc
) {
614 kprintf("vfs_nlookup: '..' traverse broke "
615 "jail: pid %d (%s)\n",
616 curthread
->td_proc
->p_pid
,
619 nctmp
= nd
->nl_rootnch
;
621 nctmp
.ncp
= nctmp
.ncp
->nc_parent
;
624 cache_unlock(&nd
->nl_nch
);
625 nd
->nl_flags
&= ~NLC_NCPISLOCKED
;
626 cache_get_maybe_shared(&nctmp
, &nch
, wantsexcllock(nd
, ptr
));
627 cache_drop(&nctmp
); /* NOTE: zero's nctmp */
632 * Must unlock nl_nch when traversing down the path. However,
633 * the child ncp has not yet been found/created and the parent's
634 * child list might be empty. Thus releasing the lock can
635 * allow a race whereby the parent ncp's vnode is recycled.
636 * This case can occur especially when maxvnodes is set very low.
638 * We need the parent's ncp to remain resolved for all normal
639 * filesystem activities, so we vhold() the vp during the lookup
640 * to prevent recyclement due to vnlru / maxvnodes.
642 * If we race an unlink or rename the ncp might be marked
643 * DESTROYED after resolution, requiring a retry.
645 if ((hvp
= nd
->nl_nch
.ncp
->nc_vp
) != NULL
)
647 cache_unlock(&nd
->nl_nch
);
648 nd
->nl_flags
&= ~NLC_NCPISLOCKED
;
649 error
= cache_nlookup_maybe_shared(&nd
->nl_nch
, &nlc
,
650 wantsexcllock(nd
, ptr
), &nch
);
651 if (error
== EWOULDBLOCK
) {
652 nch
= cache_nlookup(&nd
->nl_nch
, &nlc
);
653 if (nch
.ncp
->nc_flag
& NCF_UNRESOLVED
)
656 error
= cache_resolve(&nch
, nd
->nl_cred
);
657 if (error
!= EAGAIN
&&
658 (nch
.ncp
->nc_flag
& NCF_DESTROYED
) == 0) {
661 kprintf("[diagnostic] nlookup: relookup %*.*s\n",
662 nch
.ncp
->nc_nlen
, nch
.ncp
->nc_nlen
,
665 nch
= cache_nlookup(&nd
->nl_nch
, &nlc
);
674 * If the last component was "." or ".." our dflags no longer
675 * represents the parent directory and we have to explicitly
678 * Expect the parent to be good since nch is locked.
680 if (wasdotordotdot
&& error
== 0) {
682 if ((par
.ncp
= nch
.ncp
->nc_parent
) != NULL
) {
683 par
.mount
= nch
.mount
;
685 cache_lock_maybe_shared(&par
, wantsexcllock(nd
, ptr
));
686 error
= naccess(&par
, 0, nd
->nl_cred
, &dflags
);
692 * [end of subsection]
694 * nch is locked and referenced.
695 * nd->nl_nch is unlocked and referenced.
697 * nl_nch must be unlocked or we could chain lock to the root
698 * if a resolve gets stuck (e.g. in NFS).
700 KKASSERT((nd
->nl_flags
& NLC_NCPISLOCKED
) == 0);
703 * Resolve the namespace if necessary. The ncp returned by
704 * cache_nlookup() is referenced and locked.
706 * XXX neither '.' nor '..' should return EAGAIN since they were
707 * previously resolved and thus cannot be newly created ncp's.
709 if (nch
.ncp
->nc_flag
& NCF_UNRESOLVED
) {
711 error
= cache_resolve(&nch
, nd
->nl_cred
);
712 KKASSERT(error
!= EAGAIN
);
714 error
= nch
.ncp
->nc_error
;
718 * Early completion. ENOENT is not an error if this is the last
719 * component and NLC_CREATE or NLC_RENAME (rename target) was
720 * requested. Note that ncp->nc_error is left as ENOENT in that
721 * case, which we check later on.
723 * Also handle invalid '.' or '..' components terminating a path
724 * for a create/rename/delete. The standard requires this and pax
725 * pretty stupidly depends on it.
727 if (islastelement(ptr
)) {
728 if (error
== ENOENT
&&
729 (nd
->nl_flags
& (NLC_CREATE
| NLC_RENAME_DST
))
731 if (nd
->nl_flags
& NLC_NFS_RDONLY
) {
734 error
= naccess(&nch
, nd
->nl_flags
| dflags
,
738 if (error
== 0 && wasdotordotdot
&&
739 (nd
->nl_flags
& (NLC_CREATE
| NLC_DELETE
|
740 NLC_RENAME_SRC
| NLC_RENAME_DST
))) {
744 if (nd
->nl_flags
& NLC_CREATE
)
746 else if (nd
->nl_flags
& NLC_DELETE
)
747 error
= (wasdotordotdot
== 1) ? EINVAL
: ENOTEMPTY
;
754 * Early completion on error.
762 * If the element is a symlink and it is either not the last
763 * element or it is the last element and we are allowed to
764 * follow symlinks, resolve the symlink.
766 if ((nch
.ncp
->nc_flag
& NCF_ISSYMLINK
) &&
767 (*ptr
|| (nd
->nl_flags
& NLC_FOLLOW
))
769 if (nd
->nl_loopcnt
++ >= MAXSYMLINKS
) {
774 error
= nreadsymlink(nd
, &nch
, &nlc
);
780 * Concatenate trailing path elements onto the returned symlink.
781 * Note that if the path component (ptr) is not exhausted, it
782 * will being with a '/', so we do not have to add another one.
784 * The symlink may not be empty.
787 if (nlc
.nlc_namelen
== 0 || nlc
.nlc_namelen
+ len
>= MAXPATHLEN
) {
788 error
= nlc
.nlc_namelen
? ENAMETOOLONG
: ENOENT
;
789 objcache_put(namei_oc
, nlc
.nlc_nameptr
);
792 bcopy(ptr
, nlc
.nlc_nameptr
+ nlc
.nlc_namelen
, len
+ 1);
793 if (nd
->nl_flags
& NLC_HASBUF
)
794 objcache_put(namei_oc
, nd
->nl_path
);
795 nd
->nl_path
= nlc
.nlc_nameptr
;
796 nd
->nl_flags
|= NLC_HASBUF
;
800 * Go back up to the top to resolve any initial '/'s in the
807 * If the element is a directory and we are crossing a mount point,
810 while ((nch
.ncp
->nc_flag
& NCF_ISMOUNTPT
) &&
811 (nd
->nl_flags
& NLC_NOCROSSMOUNT
) == 0 &&
812 (mp
= cache_findmount(&nch
)) != NULL
818 * VFS must be busied before the namecache entry is locked,
819 * but we don't want to waste time calling vfs_busy() if the
820 * mount point is already resolved.
825 while (vfs_busy(mp
, 0)) {
826 if (mp
->mnt_kern_flag
& MNTK_UNMOUNT
) {
827 kprintf("nlookup: warning umount race avoided\n");
835 cache_get_maybe_shared(&mp
->mnt_ncmountpt
, &nch
,
836 wantsexcllock(nd
, ptr
));
838 if (nch
.ncp
->nc_flag
& NCF_UNRESOLVED
) {
839 if (vfs_do_busy
== 0) {
843 error
= VFS_ROOT(mp
, &tdp
);
850 cache_setvp(&nch
, tdp
);
865 * Skip any slashes to get to the next element. If there
866 * are any slashes at all the current element must be a
867 * directory or, in the create case, intended to become a directory.
868 * If it isn't we break without incrementing ptr and fall through
869 * to the failure case below.
871 while (*ptr
== '/') {
872 if ((nch
.ncp
->nc_flag
& NCF_ISDIR
) == 0 &&
873 !(nd
->nl_flags
& NLC_WILLBEDIR
)
881 * Continuation case: additional elements and the current
882 * element is a directory.
884 if (*ptr
&& (nch
.ncp
->nc_flag
& NCF_ISDIR
)) {
885 cache_drop(&nd
->nl_nch
);
887 KKASSERT((nd
->nl_flags
& NLC_NCPISLOCKED
) == 0);
893 * Failure case: additional elements and the current element
903 * Successful lookup of last element.
905 * Check permissions if the target exists. If the target does not
906 * exist directory permissions were already tested in the early
907 * completion code above.
909 * nd->nl_flags will be adjusted on return with NLC_APPENDONLY
910 * if the file is marked append-only, and NLC_STICKY if the directory
911 * containing the file is sticky.
913 if (nch
.ncp
->nc_vp
&& (nd
->nl_flags
& NLC_ALLCHKS
)) {
914 error
= naccess(&nch
, nd
->nl_flags
| dflags
,
923 * Termination: no more elements.
925 * If NLC_REFDVP is set acquire a referenced parent dvp.
927 if (nd
->nl_flags
& NLC_REFDVP
) {
928 cache_lock(&nd
->nl_nch
);
929 error
= cache_vref(&nd
->nl_nch
, nd
->nl_cred
, &nd
->nl_dvp
);
930 cache_unlock(&nd
->nl_nch
);
932 kprintf("NLC_REFDVP: Cannot ref dvp of %p\n", nch
.ncp
);
937 cache_drop(&nd
->nl_nch
);
939 nd
->nl_flags
|= NLC_NCPISLOCKED
;
945 ++gd
->gd_nchstats
->ncs_longhits
;
947 ++gd
->gd_nchstats
->ncs_longmiss
;
949 if (nd
->nl_flags
& NLC_NCPISLOCKED
)
950 KKASSERT(cache_lockstatus(&nd
->nl_nch
) > 0);
953 * NOTE: If NLC_CREATE was set the ncp may represent a negative hit
954 * (ncp->nc_error will be ENOENT), but we will still return an error
961 * Resolve a mount point's glue ncp. This ncp connects creates the illusion
962 * of continuity in the namecache tree by connecting the ncp related to the
963 * vnode under the mount to the ncp related to the mount's root vnode.
965 * If no error occured a locked, ref'd ncp is stored in *ncpp.
968 nlookup_mp(struct mount
*mp
, struct nchandle
*nch
)
974 cache_get(&mp
->mnt_ncmountpt
, nch
);
975 if (nch
->ncp
->nc_flag
& NCF_UNRESOLVED
) {
976 while (vfs_busy(mp
, 0))
978 error
= VFS_ROOT(mp
, &vp
);
983 cache_setvp(nch
, vp
);
991 * Read the contents of a symlink, allocate a path buffer out of the
992 * namei_oc and initialize the supplied nlcomponent with the result.
994 * If an error occurs no buffer will be allocated or returned in the nlc.
997 nreadsymlink(struct nlookupdata
*nd
, struct nchandle
*nch
,
998 struct nlcomponent
*nlc
)
1007 nlc
->nlc_nameptr
= NULL
;
1008 nlc
->nlc_namelen
= 0;
1009 if (nch
->ncp
->nc_vp
== NULL
)
1011 if ((error
= cache_vget(nch
, nd
->nl_cred
, LK_SHARED
, &vp
)) != 0)
1013 cp
= objcache_get(namei_oc
, M_WAITOK
);
1015 aiov
.iov_len
= MAXPATHLEN
;
1016 auio
.uio_iov
= &aiov
;
1017 auio
.uio_iovcnt
= 1;
1018 auio
.uio_offset
= 0;
1019 auio
.uio_rw
= UIO_READ
;
1020 auio
.uio_segflg
= UIO_SYSSPACE
;
1021 auio
.uio_td
= nd
->nl_td
;
1022 auio
.uio_resid
= MAXPATHLEN
- 1;
1023 error
= VOP_READLINK(vp
, &auio
, nd
->nl_cred
);
1026 linklen
= MAXPATHLEN
- 1 - auio
.uio_resid
;
1027 if (varsym_enable
) {
1028 linklen
= varsymreplace(cp
, linklen
, MAXPATHLEN
- 1);
1030 error
= ENAMETOOLONG
;
1035 nlc
->nlc_nameptr
= cp
;
1036 nlc
->nlc_namelen
= linklen
;
1040 objcache_put(namei_oc
, cp
);
1046 * Check access [XXX cache vattr!] [XXX quota]
1048 * Generally check the NLC_* access bits. All specified bits must pass
1049 * for this function to return 0.
1051 * The file does not have to exist when checking NLC_CREATE or NLC_RENAME_DST
1052 * access, otherwise it must exist. No error is returned in this case.
1054 * The file must not exist if NLC_EXCL is specified.
1056 * Directory permissions in general are tested for NLC_CREATE if the file
1057 * does not exist, NLC_DELETE if the file does exist, and NLC_RENAME_DST
1058 * whether the file exists or not.
1060 * The directory sticky bit is tested for NLC_DELETE and NLC_RENAME_DST,
1061 * the latter is only tested if the target exists.
1063 * The passed ncp must be referenced and locked. If it is already resolved
1064 * it may be locked shared but otherwise should be locked exclusively.
1067 naccess(struct nchandle
*nch
, int nflags
, struct ucred
*cred
, int *nflagsp
)
1071 struct namecache
*ncp
;
1075 KKASSERT(cache_lockstatus(nch
) > 0);
1078 if (ncp
->nc_flag
& NCF_UNRESOLVED
) {
1079 cache_resolve(nch
, cred
);
1082 error
= ncp
->nc_error
;
1085 * Directory permissions checks. Silently ignore ENOENT if these
1086 * tests pass. It isn't an error.
1088 * We can safely resolve ncp->nc_parent because ncp is currently
1091 if (nflags
& (NLC_CREATE
| NLC_DELETE
| NLC_RENAME_SRC
| NLC_RENAME_DST
)) {
1092 if (((nflags
& NLC_CREATE
) && ncp
->nc_vp
== NULL
) ||
1093 ((nflags
& NLC_DELETE
) && ncp
->nc_vp
!= NULL
) ||
1094 ((nflags
& NLC_RENAME_SRC
) && ncp
->nc_vp
!= NULL
) ||
1095 (nflags
& NLC_RENAME_DST
)
1097 struct nchandle par
;
1099 if ((par
.ncp
= ncp
->nc_parent
) == NULL
) {
1100 if (error
!= EAGAIN
)
1102 } else if (error
== 0 || error
== ENOENT
) {
1103 par
.mount
= nch
->mount
;
1105 cache_lock_maybe_shared(&par
, 0);
1106 error
= naccess(&par
, NLC_WRITE
, cred
, NULL
);
1113 * NLC_EXCL check. Target file must not exist.
1115 if (error
== 0 && (nflags
& NLC_EXCL
) && ncp
->nc_vp
!= NULL
)
1119 * Get the vnode attributes so we can do the rest of our checks.
1121 * NOTE: We only call naccess_va() if the target exists.
1124 error
= cache_vget(nch
, cred
, LK_SHARED
, &vp
);
1125 if (error
== ENOENT
) {
1127 * Silently zero-out ENOENT if creating or renaming
1128 * (rename target). It isn't an error.
1130 if (nflags
& (NLC_CREATE
| NLC_RENAME_DST
))
1132 } else if (error
== 0) {
1134 * Get the vnode attributes and check for illegal O_TRUNC
1135 * requests and read-only mounts.
1137 * NOTE: You can still open devices on read-only mounts for
1140 * NOTE: creates/deletes/renames are handled by the NLC_WRITE
1141 * check on the parent directory above.
1143 * XXX cache the va in the namecache or in the vnode
1145 error
= VOP_GETATTR(vp
, &va
);
1146 if (error
== 0 && (nflags
& NLC_TRUNCATE
)) {
1147 switch(va
.va_type
) {
1162 if (error
== 0 && (nflags
& NLC_WRITE
) && vp
->v_mount
&&
1163 (vp
->v_mount
->mnt_flag
& MNT_RDONLY
)
1165 switch(va
.va_type
) {
1179 * Check permissions based on file attributes. The passed
1180 * flags (*nflagsp) are modified with feedback based on
1181 * special attributes and requirements.
1185 * Adjust the returned (*nflagsp) if non-NULL.
1188 if ((va
.va_mode
& VSVTX
) && va
.va_uid
!= cred
->cr_uid
)
1189 *nflagsp
|= NLC_STICKY
;
1190 if (va
.va_flags
& APPEND
)
1191 *nflagsp
|= NLC_APPENDONLY
;
1192 if (va
.va_flags
& IMMUTABLE
)
1193 *nflagsp
|= NLC_IMMUTABLE
;
1197 * Track swapcache management flags in the namecache.
1199 * Calculate the flags based on the current vattr info
1200 * and recalculate the inherited flags from the parent
1201 * (the original cache linkage may have occurred without
1202 * getattrs and thus have stale flags).
1205 if (va
.va_flags
& SF_NOCACHE
)
1206 cflags
|= NCF_SF_NOCACHE
;
1207 if (va
.va_flags
& UF_CACHE
)
1208 cflags
|= NCF_UF_CACHE
;
1209 if (ncp
->nc_parent
) {
1210 if (ncp
->nc_parent
->nc_flag
&
1211 (NCF_SF_NOCACHE
| NCF_SF_PNOCACHE
)) {
1212 cflags
|= NCF_SF_PNOCACHE
;
1214 if (ncp
->nc_parent
->nc_flag
&
1215 (NCF_UF_CACHE
| NCF_UF_PCACHE
)) {
1216 cflags
|= NCF_UF_PCACHE
;
1221 * XXX we're not supposed to update nc_flag when holding
1224 atomic_clear_short(&ncp
->nc_flag
,
1225 (NCF_SF_NOCACHE
| NCF_UF_CACHE
|
1226 NCF_SF_PNOCACHE
| NCF_UF_PCACHE
) & ~cflags
);
1227 atomic_set_short(&ncp
->nc_flag
, cflags
);
1230 * Process general access.
1232 error
= naccess_va(&va
, nflags
, cred
);
1240 * Check the requested access against the given vattr using cred.
1243 naccess_va(struct vattr
*va
, int nflags
, struct ucred
*cred
)
1249 * Test the immutable bit. Creations, deletions, renames (source
1250 * or destination) are not allowed. chown/chmod/other is also not
1251 * allowed but is handled by SETATTR. Hardlinks to the immutable
1254 * If the directory is set to immutable then creations, deletions,
1255 * renames (source or dest) and hardlinks to files within the directory
1256 * are not allowed, and regular files opened through the directory may
1257 * not be written to or truncated (unless a special device).
1259 * NOTE! New hardlinks to immutable files work but new hardlinks to
1260 * files, immutable or not, sitting inside an immutable directory are
1261 * not allowed. As always if the file is hardlinked via some other
1262 * path additional hardlinks may be possible even if the file is marked
1263 * immutable. The sysop needs to create a closure by checking the hard
1264 * link count. Once closure is achieved you are good, and security
1265 * scripts should check link counts anyway.
1267 * Writes and truncations are only allowed on special devices.
1269 if ((va
->va_flags
& IMMUTABLE
) || (nflags
& NLC_IMMUTABLE
)) {
1270 if ((nflags
& NLC_IMMUTABLE
) && (nflags
& NLC_HLINK
))
1272 if (nflags
& (NLC_CREATE
| NLC_DELETE
|
1273 NLC_RENAME_SRC
| NLC_RENAME_DST
)) {
1276 if (nflags
& (NLC_WRITE
| NLC_TRUNCATE
)) {
1277 switch(va
->va_type
) {
1291 * Test the no-unlink and append-only bits for opens, rename targets,
1292 * and deletions. These bits are not tested for creations or
1295 * Unlike FreeBSD we allow a file with APPEND set to be renamed.
1296 * If you do not wish this you must also set NOUNLINK.
1298 * If the governing directory is marked APPEND-only it implies
1299 * NOUNLINK for all entries in the directory.
1301 if (((va
->va_flags
& NOUNLINK
) || (nflags
& NLC_APPENDONLY
)) &&
1302 (nflags
& (NLC_DELETE
| NLC_RENAME_SRC
| NLC_RENAME_DST
))
1308 * A file marked append-only may not be deleted but can be renamed.
1310 if ((va
->va_flags
& APPEND
) &&
1311 (nflags
& (NLC_DELETE
| NLC_RENAME_DST
))
1317 * A file marked append-only which is opened for writing must also
1318 * be opened O_APPEND.
1320 if ((va
->va_flags
& APPEND
) && (nflags
& (NLC_OPEN
| NLC_TRUNCATE
))) {
1321 if (nflags
& NLC_TRUNCATE
)
1323 if ((nflags
& (NLC_OPEN
| NLC_WRITE
)) == (NLC_OPEN
| NLC_WRITE
)) {
1324 if ((nflags
& NLC_APPEND
) == 0)
1330 * root gets universal access
1332 if (cred
->cr_uid
== 0)
1336 * Check owner perms.
1338 * If NLC_OWN is set the owner of the file is allowed no matter when
1339 * the owner-mode bits say (utimes).
1342 if (nflags
& NLC_READ
)
1344 if (nflags
& NLC_WRITE
)
1346 if (nflags
& NLC_EXEC
)
1349 if (cred
->cr_uid
== va
->va_uid
) {
1350 if ((nflags
& NLC_OWN
) == 0) {
1351 if ((vmode
& va
->va_mode
) != vmode
)
1358 * If NLC_STICKY is set only the owner may delete or rename a file.
1359 * This bit is typically set on /tmp.
1361 * Note that the NLC_READ/WRITE/EXEC bits are not typically set in
1362 * the specific delete or rename case. For deletions and renames we
1363 * usually just care about directory permissions, not file permissions.
1365 if ((nflags
& NLC_STICKY
) &&
1366 (nflags
& (NLC_RENAME_SRC
| NLC_RENAME_DST
| NLC_DELETE
))) {
1374 for (i
= 0; i
< cred
->cr_ngroups
; ++i
) {
1375 if (va
->va_gid
== cred
->cr_groups
[i
]) {
1376 if ((vmode
& va
->va_mode
) != vmode
)
1386 if ((vmode
& va
->va_mode
) != vmode
)