1/*
2 * Copyright (c) 2000-2015 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28/* Copyright (c) 1995 NeXT Computer, Inc. All Rights Reserved */
29/*
30 * Copyright (c) 1982, 1986, 1989, 1993
31 * The Regents of the University of California. All rights reserved.
32 * (c) UNIX System Laboratories, Inc.
33 * All or some portions of this file are derived from material licensed
34 * to the University of California by American Telephone and Telegraph
35 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
36 * the permission of UNIX System Laboratories, Inc.
37 *
38 * Redistribution and use in source and binary forms, with or without
39 * modification, are permitted provided that the following conditions
40 * are met:
41 * 1. Redistributions of source code must retain the above copyright
42 * notice, this list of conditions and the following disclaimer.
43 * 2. Redistributions in binary form must reproduce the above copyright
44 * notice, this list of conditions and the following disclaimer in the
45 * documentation and/or other materials provided with the distribution.
46 * 3. All advertising materials mentioning features or use of this software
47 * must display the following acknowledgement:
48 * This product includes software developed by the University of
49 * California, Berkeley and its contributors.
50 * 4. Neither the name of the University nor the names of its contributors
51 * may be used to endorse or promote products derived from this software
52 * without specific prior written permission.
53 *
54 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
55 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
56 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
57 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
58 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
59 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
60 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
61 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
62 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
63 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
64 * SUCH DAMAGE.
65 *
66 * @(#)vfs_lookup.c 8.10 (Berkeley) 5/27/95
67 */
68/*
69 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
70 * support for mandatory and extensible security protections. This notice
71 * is included in support of clause 2.2 (b) of the Apple Public License,
72 * Version 2.0.
73 */
74
75#include <sys/param.h>
76#include <sys/systm.h>
77#include <sys/syslimits.h>
78#include <sys/time.h>
79#include <sys/namei.h>
80#include <sys/vm.h>
81#include <sys/vnode_internal.h>
82#include <sys/mount_internal.h>
83#include <sys/errno.h>
84#include <kern/kalloc.h>
85#include <sys/filedesc.h>
86#include <sys/proc_internal.h>
87#include <sys/kdebug.h>
88#include <sys/unistd.h> /* For _PC_NAME_MAX */
89#include <sys/uio_internal.h>
90#include <sys/kauth.h>
91#include <kern/zalloc.h>
92#include <security/audit/audit.h>
93#if CONFIG_MACF
94#include <security/mac_framework.h>
95#endif
96#include <os/atomic_private.h>
97
98#include <sys/paths.h>
99
100#if NAMEDRSRCFORK
101#include <sys/xattr.h>
102#endif
103/*
104 * The minimum volfs-style pathname is 9.
105 * Example: "/.vol/1/2"
106 */
107#define VOLFS_MIN_PATH_LEN 9
108
109
110#if CONFIG_VOLFS
111static int vfs_getrealpath(const char * path, char * realpath, size_t bufsize, vfs_context_t ctx);
112#define MAX_VOLFS_RESTARTS 5
113#endif
114
115static int lookup_traverse_mountpoints(struct nameidata *ndp, struct componentname *cnp, vnode_t dp, int vbusyflags, vfs_context_t ctx);
116static int lookup_handle_symlink(struct nameidata *ndp, vnode_t *new_dp, bool* dp_has_iocount, vfs_context_t ctx);
117static int lookup_authorize_search(vnode_t dp, struct componentname *cnp, int dp_authorized_in_cache, vfs_context_t ctx);
118static void lookup_consider_update_cache(vnode_t dvp, vnode_t vp, struct componentname *cnp, int nc_generation);
119static int lookup_handle_found_vnode(struct nameidata *ndp, struct componentname *cnp, int rdonly,
120 int vbusyflags, int *keep_going, int nc_generation,
121 int wantparent, int atroot, vfs_context_t ctx);
122static int lookup_handle_emptyname(struct nameidata *ndp, struct componentname *cnp, int wantparent);
123
124#if NAMEDRSRCFORK
125static int lookup_handle_rsrc_fork(vnode_t dp, struct nameidata *ndp, struct componentname *cnp, int wantparent, vfs_context_t ctx);
126#endif
127
128extern lck_rw_t rootvnode_rw_lock;
129
130/*
131 * Convert a pathname into a pointer to a locked inode.
132 *
133 * The FOLLOW flag is set when symbolic links are to be followed
134 * when they occur at the end of the name translation process.
135 * Symbolic links are always followed for all other pathname
136 * components other than the last.
137 *
138 * The segflg defines whether the name is to be copied from user
139 * space or kernel space.
140 *
141 * Overall outline of namei:
142 *
143 * copy in name
144 * get starting directory
145 * while (!done && !error) {
146 * call lookup to search path.
147 * if symbolic link, massage name in buffer and continue
148 * }
149 *
150 * Returns: 0 Success
151 * ENOENT No such file or directory
152 * ELOOP Too many levels of symbolic links
153 * ENAMETOOLONG Filename too long
154 * copyinstr:EFAULT Bad address
155 * copyinstr:ENAMETOOLONG Filename too long
156 * lookup:EBADF Bad file descriptor
157 * lookup:EROFS
158 * lookup:EACCES
159 * lookup:EPERM
160 * lookup:ERECYCLE vnode was recycled from underneath us in lookup.
161 * This means we should re-drive lookup from this point.
162 * lookup: ???
163 * VNOP_READLINK:???
164 */
165int
166namei(struct nameidata *ndp)
167{
168 struct vnode *dp; /* the directory we are searching */
169 struct vnode *usedvp = ndp->ni_dvp; /* store pointer to vp in case we must loop due to
170 * heavy vnode pressure */
171 uint32_t cnpflags = ndp->ni_cnd.cn_flags; /* store in case we have to restore after loop */
172 int error;
173 struct componentname *cnp = &ndp->ni_cnd;
174 vfs_context_t ctx = cnp->cn_context;
175 proc_t p = vfs_context_proc(ctx);
176#if CONFIG_AUDIT
177/* XXX ut should be from context */
178 uthread_t ut = current_uthread();
179#endif
180
181#if CONFIG_VOLFS
182 int volfs_restarts = 0;
183#endif
184 size_t bytes_copied = 0;
185 vnode_t rootdir_with_usecount = NULLVP;
186 vnode_t startdir_with_usecount = NULLVP;
187 vnode_t usedvp_dp = NULLVP;
188 int32_t old_count = 0;
189 bool dp_has_iocount = false;
190
191#if DIAGNOSTIC
192 if (!vfs_context_ucred(ctx) || !p) {
193 panic("namei: bad cred/proc");
194 }
195 if (cnp->cn_nameiop & (~OPMASK)) {
196 panic("namei: nameiop contaminated with flags");
197 }
198 if (cnp->cn_flags & OPMASK) {
199 panic("namei: flags contaminated with nameiops");
200 }
201#endif
202
203 /*
204 * A compound VNOP found something that needs further processing:
205 * either a trigger vnode, a covered directory, or a symlink.
206 */
207 if (ndp->ni_flag & NAMEI_CONTLOOKUP) {
208 int rdonly, vbusyflags, keep_going, wantparent;
209
210 rdonly = cnp->cn_flags & RDONLY;
211 vbusyflags = ((cnp->cn_flags & CN_NBMOUNTLOOK) != 0) ? LK_NOWAIT : 0;
212 keep_going = 0;
213 wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT);
214
215 ndp->ni_flag &= ~(NAMEI_CONTLOOKUP);
216
217 error = lookup_handle_found_vnode(ndp, cnp: &ndp->ni_cnd, rdonly, vbusyflags,
218 keep_going: &keep_going, nc_generation: ndp->ni_ncgeneration, wantparent, atroot: 0, ctx);
219 if (error) {
220 goto out_drop;
221 }
222 if (keep_going) {
223 if ((cnp->cn_flags & ISSYMLINK) == 0) {
224 panic("We need to keep going on a continued lookup, but for vp type %d (tag %d)", ndp->ni_vp->v_type, ndp->ni_vp->v_tag);
225 }
226 goto continue_symlink;
227 }
228
229 return 0;
230 }
231
232vnode_recycled:
233
234 /*
235 * Get a buffer for the name to be translated, and copy the
236 * name into the buffer.
237 */
238 if ((cnp->cn_flags & HASBUF) == 0) {
239 cnp->cn_pnbuf = ndp->ni_pathbuf;
240 cnp->cn_pnlen = PATHBUFLEN;
241 }
242
243retry_copy:
244 if (UIO_SEG_IS_USER_SPACE(ndp->ni_segflg)) {
245 error = copyinstr(uaddr: ndp->ni_dirp, kaddr: cnp->cn_pnbuf,
246 len: cnp->cn_pnlen, done: &bytes_copied);
247 } else {
248 error = copystr(CAST_DOWN(void *, ndp->ni_dirp), kdaddr: cnp->cn_pnbuf,
249 len: cnp->cn_pnlen, done: &bytes_copied);
250 }
251 if (error == ENAMETOOLONG && !(cnp->cn_flags & HASBUF)) {
252 cnp->cn_pnbuf = zalloc(view: ZV_NAMEI);
253 cnp->cn_flags |= HASBUF;
254 cnp->cn_pnlen = MAXPATHLEN;
255 bytes_copied = 0;
256
257 goto retry_copy;
258 }
259 if (error) {
260 goto error_out;
261 }
262 assert(bytes_copied <= MAXPATHLEN);
263 ndp->ni_pathlen = (u_int)bytes_copied;
264 bytes_copied = 0;
265
266 /*
267 * Since the name cache may contain positive entries of
268 * the incorrect case, force lookup() to bypass the cache
269 * and call directly into the filesystem for each path
270 * component. Note: the FS may still consult the cache,
271 * but can apply rules to validate the results.
272 */
273 if (proc_is_forcing_hfs_case_sensitivity(p)) {
274 cnp->cn_flags |= CN_SKIPNAMECACHE;
275 }
276
277#if CONFIG_VOLFS
278 /*
279 * Check for legacy volfs style pathnames.
280 *
281 * For compatibility reasons we currently allow these paths,
282 * but future versions of the OS may not support them.
283 */
284 if (ndp->ni_pathlen >= VOLFS_MIN_PATH_LEN &&
285 cnp->cn_pnbuf[0] == '/' &&
286 cnp->cn_pnbuf[1] == '.' &&
287 cnp->cn_pnbuf[2] == 'v' &&
288 cnp->cn_pnbuf[3] == 'o' &&
289 cnp->cn_pnbuf[4] == 'l' &&
290 cnp->cn_pnbuf[5] == '/') {
291 char * realpath;
292 int realpath_err;
293 /* Attempt to resolve a legacy volfs style pathname. */
294 realpath = zalloc(view: ZV_NAMEI);
295 /*
296 * We only error out on the ENAMETOOLONG cases where we know that
297 * vfs_getrealpath translation succeeded but the path could not fit into
298 * MAXPATHLEN characters. In other failure cases, we may be dealing with a path
299 * that legitimately looks like /.vol/1234/567 and is not meant to be translated
300 */
301 if ((realpath_err = vfs_getrealpath(path: &cnp->cn_pnbuf[6], realpath, MAXPATHLEN, ctx))) {
302 zfree(ZV_NAMEI, realpath);
303 if (realpath_err == ENOSPC || realpath_err == ENAMETOOLONG) {
304 error = ENAMETOOLONG;
305 goto error_out;
306 }
307 } else {
308 size_t tmp_len;
309 if (cnp->cn_flags & HASBUF) {
310 zfree(ZV_NAMEI, cnp->cn_pnbuf);
311 }
312 cnp->cn_pnbuf = realpath;
313 cnp->cn_pnlen = MAXPATHLEN;
314 tmp_len = strlen(s: realpath) + 1;
315 assert(tmp_len <= UINT_MAX);
316 ndp->ni_pathlen = (u_int)tmp_len;
317 cnp->cn_flags |= HASBUF | CN_VOLFSPATH;
318 }
319 }
320#endif /* CONFIG_VOLFS */
321
322#if CONFIG_AUDIT
323 /* If we are auditing the kernel pathname, save the user pathname */
324 if (cnp->cn_flags & AUDITVNPATH1) {
325 AUDIT_ARG(upath, ut->uu_cdir, cnp->cn_pnbuf, ARG_UPATH1);
326 }
327 if (cnp->cn_flags & AUDITVNPATH2) {
328 AUDIT_ARG(upath, ut->uu_cdir, cnp->cn_pnbuf, ARG_UPATH2);
329 }
330#endif /* CONFIG_AUDIT */
331
332 /*
333 * Do not allow empty pathnames
334 */
335 if (*cnp->cn_pnbuf == '\0') {
336 error = ENOENT;
337 goto error_out;
338 }
339 if (ndp->ni_flag & NAMEI_NOFOLLOW_ANY) {
340 ndp->ni_loopcnt = MAXSYMLINKS;
341 } else {
342 ndp->ni_loopcnt = 0;
343 }
344
345 /*
346 * determine the starting point for the translation.
347 */
348 proc_dirs_lock_shared(p);
349 lck_rw_lock_shared(lck: &rootvnode_rw_lock);
350
351 if (!(ndp->ni_flag & NAMEI_ROOTDIR)) {
352 if (fdt_flag_test(&p->p_fd, FD_CHROOT)) {
353 ndp->ni_rootdir = p->p_fd.fd_rdir;
354 } else {
355 ndp->ni_rootdir = rootvnode;
356 }
357 }
358
359 if (!ndp->ni_rootdir) {
360 if (ndp->ni_flag & NAMEI_ROOTDIR) {
361 panic("NAMEI_ROOTDIR is set but ni_rootdir is not\n");
362 } else if (fdt_flag_test(&p->p_fd, FD_CHROOT)) {
363 /* This should be a panic */
364 printf("p->p_fd.fd_rdir is not set\n");
365 } else {
366 printf("rootvnode is not set\n");
367 }
368 lck_rw_unlock_shared(lck: &rootvnode_rw_lock);
369 proc_dirs_unlock_shared(p);
370 error = ENOENT;
371 goto error_out;
372 }
373
374 cnp->cn_nameptr = cnp->cn_pnbuf;
375
376 ndp->ni_usedvp = NULLVP;
377
378 if (*(cnp->cn_nameptr) == '/') {
379 while (*(cnp->cn_nameptr) == '/') {
380 cnp->cn_nameptr++;
381 ndp->ni_pathlen--;
382 }
383 dp = ndp->ni_rootdir;
384 } else if (cnp->cn_flags & USEDVP) {
385 dp = ndp->ni_dvp;
386 ndp->ni_usedvp = dp;
387 usedvp_dp = dp;
388 } else {
389 dp = vfs_context_cwd(ctx);
390 }
391
392 if (dp == NULLVP || (dp->v_lflag & VL_DEAD)) {
393 dp = NULLVP;
394 lck_rw_unlock_shared(lck: &rootvnode_rw_lock);
395 proc_dirs_unlock_shared(p);
396 error = ENOENT;
397 goto error_out;
398 }
399
400 /*
401 * We need our own usecount on the root vnode and the starting dir across
402 * the lookup. There's two things that be done here. We can hold the locks
403 * (which protect the existing usecounts on the directories) across the
404 * lookup or take our own usecount. Holding the locks across the lookup can
405 * cause deadlock issues if we re-enter namei on the same thread so the
406 * correct thing to do is to acquire our own usecount.
407 *
408 * Ideally, the usecount should be obtained by vnode_get->vnode_ref->vnode_put.
409 * However when this vnode is the rootvnode, that sequence will produce a
410 * lot of vnode mutex locks and unlocks on a single vnode (the rootvnode)
411 * and will be highly contended and degrade performance. Since we have
412 * an existing usecount protected by the locks we hold, we'll just use
413 * an atomic op to increment the usecount on a vnode which already has one
414 * and can't be released because we have the locks which protect against that
415 * happening.
416 */
417 rootdir_with_usecount = ndp->ni_rootdir;
418 old_count = os_atomic_inc_orig(&rootdir_with_usecount->v_usecount, relaxed);
419 if (old_count < 1) {
420 panic("(1) invalid pre-increment usecount (%d) for rootdir vnode %p",
421 old_count, rootdir_with_usecount);
422 } else if (old_count == INT32_MAX) {
423 panic("(1) usecount overflow for vnode %p", rootdir_with_usecount);
424 }
425
426 if ((dp != rootdir_with_usecount) && (dp != usedvp_dp)) {
427 old_count = os_atomic_inc_orig(&dp->v_usecount, relaxed);
428 if (old_count < 1) {
429 panic("(2) invalid pre-increment usecount (%d) for vnode %p", old_count, dp);
430 } else if (old_count == INT32_MAX) {
431 panic("(2) usecount overflow for vnode %p", dp);
432 }
433 startdir_with_usecount = dp;
434 }
435
436 /* Now that we have our usecount, release the locks */
437 lck_rw_unlock_shared(lck: &rootvnode_rw_lock);
438 proc_dirs_unlock_shared(p);
439
440 ndp->ni_dvp = NULLVP;
441 ndp->ni_vp = NULLVP;
442
443 for (;;) {
444#if CONFIG_MACF
445 /*
446 * Give MACF policies a chance to reject the lookup
447 * before performing any filesystem operations.
448 * This hook is called before resolving the path and
449 * again each time a symlink is encountered.
450 * NB: policies receive path information as supplied
451 * by the caller and thus cannot be trusted.
452 */
453 error = mac_vnode_check_lookup_preflight(ctx, dvp: dp, path: cnp->cn_nameptr, pathlen: cnp->cn_namelen);
454 if (error) {
455 goto error_out;
456 }
457#endif
458 ndp->ni_startdir = dp;
459 dp = NULLVP;
460
461 if ((error = lookup(ndp))) {
462 goto error_out;
463 }
464
465 /*
466 * Check for symbolic link
467 */
468 if ((cnp->cn_flags & ISSYMLINK) == 0) {
469 if (startdir_with_usecount) {
470 vnode_rele(vp: startdir_with_usecount);
471 startdir_with_usecount = NULLVP;
472 }
473 if (rootdir_with_usecount) {
474 lck_rw_lock_shared(lck: &rootvnode_rw_lock);
475 if (rootdir_with_usecount == rootvnode) {
476 old_count = os_atomic_dec_orig(&rootdir_with_usecount->v_usecount, relaxed);
477 if (old_count < 2) {
478 /*
479 * There needs to have been at least 1 usecount left on the rootvnode
480 */
481 panic("(3) Unexpected pre-decrement value (%d) of usecount for rootvnode %p",
482 old_count, rootdir_with_usecount);
483 }
484 rootdir_with_usecount = NULLVP;
485 }
486 lck_rw_unlock_shared(lck: &rootvnode_rw_lock);
487 if (rootdir_with_usecount) {
488 vnode_rele(vp: rootdir_with_usecount);
489 rootdir_with_usecount = NULLVP;
490 }
491 }
492
493 return 0;
494 }
495
496continue_symlink:
497 /* Gives us a new path to process, and a starting dir */
498 error = lookup_handle_symlink(ndp, new_dp: &dp, dp_has_iocount: &dp_has_iocount, ctx);
499 if (error != 0) {
500 break;
501 }
502 if (dp_has_iocount) {
503 if ((dp != rootdir_with_usecount) && (dp != startdir_with_usecount) &&
504 (dp != usedvp_dp)) {
505 if (startdir_with_usecount) {
506 vnode_rele(vp: startdir_with_usecount);
507 }
508 vnode_ref_ext(dp, 0, VNODE_REF_FORCE);
509 startdir_with_usecount = dp;
510 }
511 vnode_put(vp: dp);
512 dp_has_iocount = false;
513 }
514 }
515 /*
516 * only come here if we fail to handle a SYMLINK...
517 * if either ni_dvp or ni_vp is non-NULL, then
518 * we need to drop the iocount that was picked
519 * up in the lookup routine
520 */
521out_drop:
522 if (ndp->ni_dvp) {
523 vnode_put(vp: ndp->ni_dvp);
524 }
525 if (ndp->ni_vp) {
526 vnode_put(vp: ndp->ni_vp);
527 }
528error_out:
529 if (startdir_with_usecount) {
530 vnode_rele(vp: startdir_with_usecount);
531 startdir_with_usecount = NULLVP;
532 }
533 if (rootdir_with_usecount) {
534 lck_rw_lock_shared(lck: &rootvnode_rw_lock);
535 if (rootdir_with_usecount == rootvnode) {
536 old_count = os_atomic_dec_orig(&rootdir_with_usecount->v_usecount, relaxed);
537 if (old_count < 2) {
538 /*
539 * There needs to have been at least 1 usecount left on the rootvnode
540 */
541 panic("(4) Unexpected pre-decrement value (%d) of usecount for rootvnode %p",
542 old_count, rootdir_with_usecount);
543 }
544 lck_rw_unlock_shared(lck: &rootvnode_rw_lock);
545 } else {
546 lck_rw_unlock_shared(lck: &rootvnode_rw_lock);
547 vnode_rele(vp: rootdir_with_usecount);
548 }
549 rootdir_with_usecount = NULLVP;
550 }
551
552 if ((cnp->cn_flags & HASBUF)) {
553 cnp->cn_flags &= ~HASBUF;
554 zfree(ZV_NAMEI, cnp->cn_pnbuf);
555 }
556 cnp->cn_pnbuf = NULL;
557 ndp->ni_vp = NULLVP;
558 ndp->ni_dvp = NULLVP;
559
560#if CONFIG_VOLFS
561 /*
562 * Deal with volfs fallout.
563 *
564 * At this point, if we were originally given a volfs path that
565 * looks like /.vol/123/456, then we would have had to convert it into
566 * a full path. Assuming that part worked properly, we will now attempt
567 * to conduct a lookup of the item in the namespace. Under normal
568 * circumstances, if a user looked up /tmp/foo and it was not there, it
569 * would be permissible to return ENOENT.
570 *
571 * However, we may not want to do that here. Specifically, the volfs path
572 * uniquely identifies a certain item in the namespace regardless of where it
573 * lives. If the item has moved in between the time we constructed the
574 * path and now, when we're trying to do a lookup/authorization on the full
575 * path, we may have gotten an ENOENT.
576 *
577 * At this point we can no longer tell if the path no longer exists
578 * or if the item in question no longer exists. It could have been renamed
579 * away, in which case the /.vol identifier is still valid.
580 *
581 * Do this dance a maximum of MAX_VOLFS_RESTARTS times.
582 */
583 if ((error == ENOENT) && (ndp->ni_cnd.cn_flags & CN_VOLFSPATH)) {
584 if (volfs_restarts < MAX_VOLFS_RESTARTS) {
585 volfs_restarts++;
586 goto vnode_recycled;
587 }
588 }
589#endif
590
591 if (error == ERECYCLE) {
592 /* vnode was recycled underneath us. re-drive lookup to start at
593 * the beginning again, since recycling invalidated last lookup*/
594 ndp->ni_cnd.cn_flags = cnpflags;
595 ndp->ni_dvp = usedvp;
596 goto vnode_recycled;
597 }
598
599
600 return error;
601}
602
603int
604namei_compound_available(vnode_t dp, struct nameidata *ndp)
605{
606 if ((ndp->ni_flag & NAMEI_COMPOUNDOPEN) != 0) {
607 return vnode_compound_open_available(vp: dp);
608 }
609
610 return 0;
611}
612
613static int
614lookup_authorize_search(vnode_t dp, struct componentname *cnp, int dp_authorized_in_cache, vfs_context_t ctx)
615{
616#if !CONFIG_MACF
617#pragma unused(cnp)
618#endif
619
620 int error;
621
622 if (!dp_authorized_in_cache) {
623 error = vnode_authorize(vp: dp, NULL, KAUTH_VNODE_SEARCH, ctx);
624 if (error) {
625 return error;
626 }
627 }
628#if CONFIG_MACF
629 error = mac_vnode_check_lookup(ctx, dvp: dp, cnp);
630 if (error) {
631 return error;
632 }
633#endif /* CONFIG_MACF */
634
635 return 0;
636}
637
638static void
639lookup_consider_update_cache(vnode_t dvp, vnode_t vp, struct componentname *cnp, int nc_generation)
640{
641 int isdot_or_dotdot;
642 isdot_or_dotdot = (cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.') || (cnp->cn_flags & ISDOTDOT);
643
644 if (vp->v_name == NULL || vp->v_parent == NULLVP) {
645 int update_flags = 0;
646
647 if (isdot_or_dotdot == 0) {
648 if (vp->v_name == NULL) {
649 update_flags |= VNODE_UPDATE_NAME;
650 }
651 if (dvp != NULLVP && vp->v_parent == NULLVP) {
652 update_flags |= VNODE_UPDATE_PARENT;
653 }
654
655 if (update_flags) {
656 vnode_update_identity(vp, dvp, name: cnp->cn_nameptr, name_len: cnp->cn_namelen, name_hashval: cnp->cn_hash, flags: update_flags);
657 }
658 }
659 }
660 if ((cnp->cn_flags & MAKEENTRY) && (vp->v_flag & VNCACHEABLE) && LIST_FIRST(&vp->v_nclinks) == NULL) {
661 /*
662 * missing from name cache, but should
663 * be in it... this can happen if volfs
664 * causes the vnode to be created or the
665 * name cache entry got recycled but the
666 * vnode didn't...
667 * check to make sure that ni_dvp is valid
668 * cache_lookup_path may return a NULL
669 * do a quick check to see if the generation of the
670 * directory matches our snapshot... this will get
671 * rechecked behind the name cache lock, but if it
672 * already fails to match, no need to go any further
673 */
674 if (dvp != NULLVP && (nc_generation == dvp->v_nc_generation) && (!isdot_or_dotdot)) {
675 cache_enter_with_gen(dvp, vp, cnp, gen: nc_generation);
676 }
677 }
678}
679
680#if NAMEDRSRCFORK
681/*
682 * Can change ni_dvp and ni_vp. On success, returns with iocounts on stream vnode (always) and
683 * data fork if requested. On failure, returns with iocount data fork (always) and its parent directory
684 * (if one was provided).
685 */
686static int
687lookup_handle_rsrc_fork(vnode_t dp, struct nameidata *ndp, struct componentname *cnp, int wantparent, vfs_context_t ctx)
688{
689 vnode_t svp = NULLVP;
690 enum nsoperation nsop;
691 int nsflags;
692 int error;
693
694 if (dp->v_type != VREG) {
695 error = ENOENT;
696 goto out;
697 }
698 switch (cnp->cn_nameiop) {
699 case DELETE:
700 if (cnp->cn_flags & CN_ALLOWRSRCFORK) {
701 nsop = NS_DELETE;
702 } else {
703 error = EPERM;
704 goto out;
705 }
706 break;
707 case CREATE:
708 if (cnp->cn_flags & CN_ALLOWRSRCFORK) {
709 nsop = NS_CREATE;
710 } else {
711 error = EPERM;
712 goto out;
713 }
714 break;
715 case LOOKUP:
716 /* Make sure our lookup of "/..namedfork/rsrc" is allowed. */
717 if (cnp->cn_flags & CN_ALLOWRSRCFORK) {
718 nsop = NS_OPEN;
719 } else {
720 error = EPERM;
721 goto out;
722 }
723 break;
724 default:
725 error = EPERM;
726 goto out;
727 }
728
729 nsflags = 0;
730 if (cnp->cn_flags & CN_RAW_ENCRYPTED) {
731 nsflags |= NS_GETRAWENCRYPTED;
732 }
733
734 /* Ask the file system for the resource fork. */
735 error = vnode_getnamedstream(dp, &svp, XATTR_RESOURCEFORK_NAME, nsop, nsflags, ctx);
736
737 /* During a create, it OK for stream vnode to be missing. */
738 if (error == ENOATTR || error == ENOENT) {
739 error = (nsop == NS_CREATE) ? 0 : ENOENT;
740 }
741 if (error) {
742 goto out;
743 }
744 /* The "parent" of the stream is the file. */
745 if (wantparent) {
746 if (ndp->ni_dvp) {
747 vnode_put(vp: ndp->ni_dvp);
748 }
749 ndp->ni_dvp = dp;
750 } else {
751 vnode_put(vp: dp);
752 }
753 ndp->ni_vp = svp; /* on create this may be null */
754
755 /* Restore the truncated pathname buffer (for audits). */
756 if (ndp->ni_pathlen == 1 && ndp->ni_next[0] == '\0') {
757 /*
758 * While we replaced only '/' with '\0' and would ordinarily
759 * need to just switch that back, the buffer in which we did
760 * this may not be what the pathname buffer is now when symlinks
761 * are involved. If we just restore the "/" we will make the
762 * string not terminated anymore, so be safe and restore the
763 * entire suffix.
764 */
765 strncpy(ndp->ni_next, _PATH_RSRCFORKSPEC, sizeof(_PATH_RSRCFORKSPEC));
766 cnp->cn_nameptr = ndp->ni_next + 1;
767 cnp->cn_namelen = sizeof(_PATH_RSRCFORKSPEC) - 1;
768 ndp->ni_next += cnp->cn_namelen;
769 if (ndp->ni_next[0] != '\0') {
770 panic("Incorrect termination of path in %s", __FUNCTION__);
771 }
772 }
773 cnp->cn_flags &= ~MAKEENTRY;
774
775 return 0;
776out:
777 return error;
778}
779#endif /* NAMEDRSRCFORK */
780
781/*
782 * iocounts in:
783 * --One on ni_vp. One on ni_dvp if there is more path, or we didn't come through the
784 * cache, or we came through the cache and the caller doesn't want the parent.
785 *
786 * iocounts out:
787 * --Leaves us in the correct state for the next step, whatever that might be.
788 * --If we find a symlink, returns with iocounts on both ni_vp and ni_dvp.
789 * --If we are to look up another component, then we have an iocount on ni_vp and
790 * nothing else.
791 * --If we are done, returns an iocount on ni_vp, and possibly on ni_dvp depending on nameidata flags.
792 * --In the event of an error, may return with ni_dvp NULL'ed out (in which case, iocount
793 * was dropped).
794 */
795static int
796lookup_handle_found_vnode(struct nameidata *ndp, struct componentname *cnp, int rdonly,
797 int vbusyflags, int *keep_going, int nc_generation,
798 int wantparent, int atroot, vfs_context_t ctx)
799{
800 vnode_t dp;
801 int error;
802 char *cp;
803
804 dp = ndp->ni_vp;
805 *keep_going = 0;
806
807 if (ndp->ni_vp == NULLVP) {
808 panic("NULL ni_vp in %s", __FUNCTION__);
809 }
810
811 if (atroot) {
812 goto nextname;
813 }
814
815 /*
816 * Take into account any additional components consumed by
817 * the underlying filesystem.
818 */
819 if (cnp->cn_consume > 0) {
820 cnp->cn_nameptr += cnp->cn_consume;
821 ndp->ni_next += cnp->cn_consume;
822 ndp->ni_pathlen -= cnp->cn_consume;
823 cnp->cn_consume = 0;
824 } else {
825 lookup_consider_update_cache(dvp: ndp->ni_dvp, vp: dp, cnp, nc_generation);
826 }
827
828 /*
829 * Check to see if the vnode has been mounted on...
830 * if so find the root of the mounted file system.
831 * Updates ndp->ni_vp.
832 */
833 error = lookup_traverse_mountpoints(ndp, cnp, dp, vbusyflags, ctx);
834 dp = ndp->ni_vp;
835 if (error) {
836 goto out;
837 }
838
839#if CONFIG_MACF
840 if (vfs_flags(mp: vnode_mount(vp: dp)) & MNT_MULTILABEL) {
841 error = vnode_label(mp: vnode_mount(vp: dp), NULL, vp: dp, NULL, flags: 0, ctx);
842 if (error) {
843 goto out;
844 }
845 }
846#endif
847
848 /*
849 * Check for symbolic link
850 */
851 if ((dp->v_type == VLNK) &&
852 ((cnp->cn_flags & FOLLOW) || (ndp->ni_flag & NAMEI_TRAILINGSLASH) || *ndp->ni_next == '/')) {
853 cnp->cn_flags |= ISSYMLINK;
854 *keep_going = 1;
855 return 0;
856 }
857
858 /*
859 * Check for bogus trailing slashes.
860 */
861 if ((ndp->ni_flag & NAMEI_TRAILINGSLASH)) {
862 if (dp->v_type != VDIR) {
863 error = ENOTDIR;
864 goto out;
865 }
866 ndp->ni_flag &= ~(NAMEI_TRAILINGSLASH);
867 }
868
869#if NAMEDSTREAMS
870 /*
871 * Deny namei/lookup requests to resolve paths that point to shadow files.
872 * Access to shadow files must be conducted by explicit calls to VNOP_LOOKUP
873 * directly, and not use lookup/namei
874 */
875 if (vnode_isshadow(dp)) {
876 error = ENOENT;
877 goto out;
878 }
879#endif
880
881nextname:
882 /*
883 * Not a symbolic link. If more pathname,
884 * continue at next component, else return.
885 *
886 * Definitely have a dvp if there's another slash
887 */
888 if (*ndp->ni_next == '/') {
889 cnp->cn_nameptr = ndp->ni_next + 1;
890 ndp->ni_pathlen--;
891 while (*cnp->cn_nameptr == '/') {
892 cnp->cn_nameptr++;
893 ndp->ni_pathlen--;
894 }
895
896 cp = cnp->cn_nameptr;
897 vnode_put(vp: ndp->ni_dvp);
898 ndp->ni_dvp = NULLVP;
899
900 if (*cp == '\0') {
901 goto emptyname;
902 }
903
904 *keep_going = 1;
905 return 0;
906 }
907
908 /*
909 * Disallow directory write attempts on read-only file systems.
910 */
911 if (rdonly &&
912 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) {
913 error = EROFS;
914 goto out;
915 }
916
917 /* If SAVESTART is set, we should have a dvp */
918 if (cnp->cn_flags & SAVESTART) {
919 /*
920 * note that we already hold a reference
921 * on both dp and ni_dvp, but for some reason
922 * can't get another one... in this case we
923 * need to do vnode_put on dp in 'bad2'
924 */
925 if ((vnode_get(ndp->ni_dvp))) {
926 error = ENOENT;
927 goto out;
928 }
929 ndp->ni_startdir = ndp->ni_dvp;
930 }
931 if (!wantparent && ndp->ni_dvp) {
932 vnode_put(vp: ndp->ni_dvp);
933 ndp->ni_dvp = NULLVP;
934 }
935
936 if (cnp->cn_flags & AUDITVNPATH1) {
937 AUDIT_ARG(vnpath, dp, ARG_VNODE1);
938 } else if (cnp->cn_flags & AUDITVNPATH2) {
939 AUDIT_ARG(vnpath, dp, ARG_VNODE2);
940 }
941
942#if NAMEDRSRCFORK
943 /*
944 * Caller wants the resource fork.
945 */
946 if ((cnp->cn_flags & CN_WANTSRSRCFORK) && (dp != NULLVP)) {
947 error = lookup_handle_rsrc_fork(dp, ndp, cnp, wantparent, ctx);
948 if (error != 0) {
949 goto out;
950 }
951
952 dp = ndp->ni_vp;
953 }
954#endif
955 if (kdebug_enable) {
956 kdebug_lookup(dp: ndp->ni_vp, cnp);
957 }
958
959 return 0;
960
961emptyname:
962 error = lookup_handle_emptyname(ndp, cnp, wantparent);
963 if (error != 0) {
964 goto out;
965 }
966
967 return 0;
968out:
969 return error;
970}
971
972/*
973 * Comes in iocount on ni_vp. May overwrite ni_dvp, but doesn't interpret incoming value.
974 */
975static int
976lookup_handle_emptyname(struct nameidata *ndp, struct componentname *cnp, int wantparent)
977{
978 vnode_t dp;
979 int error = 0;
980
981 dp = ndp->ni_vp;
982 cnp->cn_namelen = 0;
983 /*
984 * A degenerate name (e.g. / or "") which is a way of
985 * talking about a directory, e.g. like "/." or ".".
986 */
987 if (dp->v_type != VDIR) {
988 error = ENOTDIR;
989 goto out;
990 }
991 if (cnp->cn_nameiop == CREATE && dp == rootvnode) {
992 error = EEXIST;
993 goto out;
994 }
995 if (cnp->cn_nameiop != LOOKUP) {
996 error = EISDIR;
997 goto out;
998 }
999 if (wantparent) {
1000 /*
1001 * note that we already hold a reference
1002 * on dp, but for some reason can't
1003 * get another one... in this case we
1004 * need to do vnode_put on dp in 'bad'
1005 */
1006 if ((vnode_get(dp))) {
1007 error = ENOENT;
1008 goto out;
1009 }
1010 ndp->ni_dvp = dp;
1011 }
1012 cnp->cn_flags &= ~ISDOTDOT;
1013 cnp->cn_flags |= ISLASTCN;
1014 ndp->ni_next = cnp->cn_nameptr;
1015 ndp->ni_vp = dp;
1016
1017 if (cnp->cn_flags & AUDITVNPATH1) {
1018 AUDIT_ARG(vnpath, dp, ARG_VNODE1);
1019 } else if (cnp->cn_flags & AUDITVNPATH2) {
1020 AUDIT_ARG(vnpath, dp, ARG_VNODE2);
1021 }
1022 if (cnp->cn_flags & SAVESTART) {
1023 panic("lookup: SAVESTART");
1024 }
1025
1026 return 0;
1027out:
1028 return error;
1029}
1030/*
1031 * Search a pathname.
1032 * This is a very central and rather complicated routine.
1033 *
1034 * The pathname is pointed to by ni_ptr and is of length ni_pathlen.
1035 * The starting directory is taken from ni_startdir. The pathname is
1036 * descended until done, or a symbolic link is encountered. The variable
1037 * ni_more is clear if the path is completed; it is set to one if a
1038 * symbolic link needing interpretation is encountered.
1039 *
1040 * The flag argument is LOOKUP, CREATE, RENAME, or DELETE depending on
1041 * whether the name is to be looked up, created, renamed, or deleted.
1042 * When CREATE, RENAME, or DELETE is specified, information usable in
1043 * creating, renaming, or deleting a directory entry may be calculated.
1044 * If flag has LOCKPARENT or'ed into it, the parent directory is returned
1045 * locked. If flag has WANTPARENT or'ed into it, the parent directory is
1046 * returned unlocked. Otherwise the parent directory is not returned. If
1047 * the target of the pathname exists and LOCKLEAF is or'ed into the flag
1048 * the target is returned locked, otherwise it is returned unlocked.
1049 * When creating or renaming and LOCKPARENT is specified, the target may not
1050 * be ".". When deleting and LOCKPARENT is specified, the target may be ".".
1051 *
1052 * Overall outline of lookup:
1053 *
1054 * dirloop:
1055 * identify next component of name at ndp->ni_ptr
1056 * handle degenerate case where name is null string
1057 * if .. and crossing mount points and on mounted filesys, find parent
1058 * call VNOP_LOOKUP routine for next component name
1059 * directory vnode returned in ni_dvp, unlocked unless LOCKPARENT set
1060 * component vnode returned in ni_vp (if it exists), locked.
1061 * if result vnode is mounted on and crossing mount points,
1062 * find mounted on vnode
1063 * if more components of name, do next level at dirloop
1064 * return the answer in ni_vp, locked if LOCKLEAF set
1065 * if LOCKPARENT set, return locked parent in ni_dvp
1066 * if WANTPARENT set, return unlocked parent in ni_dvp
1067 *
1068 * Returns: 0 Success
1069 * ENOENT No such file or directory
1070 * EBADF Bad file descriptor
1071 * ENOTDIR Not a directory
1072 * EROFS Read-only file system [CREATE]
1073 * EISDIR Is a directory [CREATE]
1074 * cache_lookup_path:ERECYCLE (vnode was recycled from underneath us, redrive lookup again)
1075 * vnode_authorize:EROFS
1076 * vnode_authorize:EACCES
1077 * vnode_authorize:EPERM
1078 * vnode_authorize:???
1079 * VNOP_LOOKUP:ENOENT No such file or directory
1080 * VNOP_LOOKUP:EJUSTRETURN Restart system call (INTERNAL)
1081 * VNOP_LOOKUP:???
1082 * VFS_ROOT:ENOTSUP
1083 * VFS_ROOT:ENOENT
1084 * VFS_ROOT:???
1085 */
1086int
1087lookup(struct nameidata *ndp)
1088{
1089 char *cp; /* pointer into pathname argument */
1090 vnode_t tdp; /* saved dp */
1091 vnode_t dp; /* the directory we are searching */
1092 int docache = 1; /* == 0 do not cache last component */
1093 int wantparent; /* 1 => wantparent or lockparent flag */
1094 int rdonly; /* lookup read-only flag bit */
1095 int dp_authorized = 0;
1096 int error = 0;
1097 struct componentname *cnp = &ndp->ni_cnd;
1098 vfs_context_t ctx = cnp->cn_context;
1099 int vbusyflags = 0;
1100 int nc_generation = 0;
1101 vnode_t last_dp = NULLVP;
1102 int keep_going;
1103 int atroot;
1104
1105 /*
1106 * Setup: break out flag bits into variables.
1107 */
1108 if (cnp->cn_flags & NOCACHE) {
1109 docache = 0;
1110 }
1111 wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT);
1112 rdonly = cnp->cn_flags & RDONLY;
1113 cnp->cn_flags &= ~ISSYMLINK;
1114 cnp->cn_consume = 0;
1115
1116 dp = ndp->ni_startdir;
1117 ndp->ni_startdir = NULLVP;
1118
1119 if ((cnp->cn_flags & CN_NBMOUNTLOOK) != 0) {
1120 vbusyflags = LK_NOWAIT;
1121 }
1122 cp = cnp->cn_nameptr;
1123
1124 if (*cp == '\0') {
1125 if ((vnode_getwithref(vp: dp))) {
1126 dp = NULLVP;
1127 error = ENOENT;
1128 goto bad;
1129 }
1130 ndp->ni_vp = dp;
1131 error = lookup_handle_emptyname(ndp, cnp, wantparent);
1132 if (error) {
1133 goto bad;
1134 }
1135
1136 return 0;
1137 }
1138dirloop:
1139 atroot = 0;
1140 ndp->ni_vp = NULLVP;
1141
1142 if ((error = cache_lookup_path(ndp, cnp, dp, context: ctx, dp_authorized: &dp_authorized, last_dp))) {
1143 dp = NULLVP;
1144 goto bad;
1145 }
1146 if ((cnp->cn_flags & ISLASTCN)) {
1147 if (docache) {
1148 cnp->cn_flags |= MAKEENTRY;
1149 }
1150 } else {
1151 cnp->cn_flags |= MAKEENTRY;
1152 }
1153
1154 dp = ndp->ni_dvp;
1155
1156 if (ndp->ni_vp != NULLVP) {
1157 /*
1158 * cache_lookup_path returned a non-NULL ni_vp then,
1159 * we're guaranteed that the dp is a VDIR, it's
1160 * been authorized, and vp is not ".."
1161 *
1162 * make sure we don't try to enter the name back into
1163 * the cache if this vp is purged before we get to that
1164 * check since we won't have serialized behind whatever
1165 * activity is occurring in the FS that caused the purge
1166 */
1167 if (dp != NULLVP) {
1168 nc_generation = dp->v_nc_generation - 1;
1169 }
1170
1171 goto returned_from_lookup_path;
1172 }
1173
1174 /*
1175 * Handle "..": two special cases.
1176 * 1. If at root directory (e.g. after chroot)
1177 * or at absolute root directory
1178 * then ignore it so can't get out.
1179 * 2. If this vnode is the root of a mounted
1180 * filesystem, then replace it with the
1181 * vnode which was mounted on so we take the
1182 * .. in the other file system.
1183 */
1184 if ((cnp->cn_flags & ISDOTDOT)) {
1185 /*
1186 * if this is a chroot'ed process, check if the current
1187 * directory is still a subdirectory of the process's
1188 * root directory.
1189 */
1190 if (ndp->ni_rootdir && (ndp->ni_rootdir != rootvnode) &&
1191 dp != ndp->ni_rootdir) {
1192 int sdir_error;
1193 int is_subdir = FALSE;
1194
1195 sdir_error = vnode_issubdir(vp: dp, dvp: ndp->ni_rootdir,
1196 is_subdir: &is_subdir, ctx: vfs_context_kernel());
1197
1198 /*
1199 * If we couldn't determine if dp is a subdirectory of
1200 * ndp->ni_rootdir (sdir_error != 0), we let the request
1201 * proceed.
1202 */
1203 if (!sdir_error && !is_subdir) {
1204 vnode_put(vp: dp);
1205 dp = ndp->ni_rootdir;
1206 /*
1207 * There's a ref on the process's root directory
1208 * but we can't use vnode_getwithref here as
1209 * there is nothing preventing that ref being
1210 * released by another thread.
1211 */
1212 if (vnode_get(dp)) {
1213 error = ENOENT;
1214 goto bad;
1215 }
1216 }
1217 }
1218
1219 for (;;) {
1220 if (dp == ndp->ni_rootdir || dp == rootvnode) {
1221 ndp->ni_dvp = dp;
1222 ndp->ni_vp = dp;
1223 /*
1224 * we're pinned at the root
1225 * we've already got one reference on 'dp'
1226 * courtesy of cache_lookup_path... take
1227 * another one for the ".."
1228 * if we fail to get the new reference, we'll
1229 * drop our original down in 'bad'
1230 */
1231 if ((vnode_get(dp))) {
1232 error = ENOENT;
1233 goto bad;
1234 }
1235 atroot = 1;
1236 goto returned_from_lookup_path;
1237 }
1238 if ((dp->v_flag & VROOT) == 0 ||
1239 (cnp->cn_flags & NOCROSSMOUNT)) {
1240 break;
1241 }
1242 if (dp->v_mount == NULL) { /* forced umount */
1243 error = EBADF;
1244 goto bad;
1245 }
1246 tdp = dp;
1247 dp = tdp->v_mount->mnt_vnodecovered;
1248
1249 if ((vnode_getwithref(vp: dp))) {
1250 vnode_put(vp: tdp);
1251 dp = NULLVP;
1252 error = ENOENT;
1253 goto bad;
1254 }
1255
1256 vnode_put(vp: tdp);
1257
1258 ndp->ni_dvp = dp;
1259 dp_authorized = 0;
1260 }
1261 }
1262
1263 /*
1264 * We now have a segment name to search for, and a directory to search.
1265 */
1266#if CONFIG_UNION_MOUNTS
1267unionlookup:
1268#endif /* CONFIG_UNION_MOUNTS */
1269 ndp->ni_vp = NULLVP;
1270
1271 if (dp->v_type != VDIR) {
1272 error = ENOTDIR;
1273 goto lookup_error;
1274 }
1275 if ((cnp->cn_flags & DONOTAUTH) != DONOTAUTH) {
1276 error = lookup_authorize_search(dp, cnp, dp_authorized_in_cache: dp_authorized, ctx);
1277 if (error) {
1278 goto lookup_error;
1279 }
1280 }
1281
1282 /*
1283 * Now that we've authorized a lookup, can bail out if the filesystem
1284 * will be doing a batched operation. Return an iocount on dvp.
1285 */
1286#if NAMEDRSRCFORK
1287 if ((cnp->cn_flags & ISLASTCN) && namei_compound_available(dp, ndp) && !(cnp->cn_flags & CN_WANTSRSRCFORK)) {
1288#else
1289 if ((cnp->cn_flags & ISLASTCN) && namei_compound_available(dp, ndp)) {
1290#endif /* NAMEDRSRCFORK */
1291 ndp->ni_flag |= NAMEI_UNFINISHED;
1292 ndp->ni_ncgeneration = dp->v_nc_generation;
1293 return 0;
1294 }
1295
1296 nc_generation = dp->v_nc_generation;
1297
1298 /*
1299 * Note:
1300 * Filesystems that support hardlinks may want to call vnode_update_identity
1301 * if the lookup operation below will modify the in-core vnode to belong to a new point
1302 * in the namespace. VFS cannot infer whether or not the look up operation makes the vnode
1303 * name change or change parents. Without this, the lookup may make update
1304 * filesystem-specific in-core metadata but fail to update the v_parent or v_name
1305 * fields in the vnode. If VFS were to do this, it would be necessary to call
1306 * vnode_update_identity on every lookup operation -- expensive!
1307 *
1308 * However, even with this in place, multiple lookups may occur in between this lookup
1309 * and the subsequent vnop, so, at best, we could only guarantee that you would get a
1310 * valid path back, and not necessarily the one that you wanted.
1311 *
1312 * Example:
1313 * /tmp/a == /foo/b
1314 *
1315 * If you are now looking up /foo/b and the vnode for this link represents /tmp/a,
1316 * vnode_update_identity will fix the parentage so that you can get /foo/b back
1317 * through the v_parent chain (preventing you from getting /tmp/b back). It would
1318 * not fix whether or not you should or should not get /tmp/a vs. /foo/b.
1319 */
1320
1321 error = VNOP_LOOKUP(dp, &ndp->ni_vp, cnp, ctx);
1322
1323 if (error) {
1324lookup_error:
1325#if CONFIG_UNION_MOUNTS
1326 if ((error == ENOENT) &&
1327 (dp->v_mount != NULL) &&
1328 (dp->v_mount->mnt_flag & MNT_UNION)) {
1329 tdp = dp;
1330 error = lookup_traverse_union(dvp: tdp, new_dvp: &dp, ctx);
1331 vnode_put(vp: tdp);
1332 if (error) {
1333 dp = NULLVP;
1334 goto bad;
1335 }
1336
1337 ndp->ni_dvp = dp;
1338 dp_authorized = 0;
1339 goto unionlookup;
1340 }
1341#endif /* CONFIG_UNION_MOUNTS */
1342
1343 if (error != EJUSTRETURN) {
1344 goto bad;
1345 }
1346
1347 if (ndp->ni_vp != NULLVP) {
1348 panic("leaf should be empty");
1349 }
1350
1351#if NAMEDRSRCFORK
1352 /*
1353 * At this point, error should be EJUSTRETURN.
1354 *
1355 * If CN_WANTSRSRCFORK is set, that implies that the
1356 * underlying filesystem could not find the "parent" of the
1357 * resource fork (the data fork), and we are doing a lookup
1358 * for a CREATE event.
1359 *
1360 * However, this should be converted to an error, as the
1361 * failure to find this parent should disallow further
1362 * progress to try and acquire a resource fork vnode.
1363 */
1364 if (cnp->cn_flags & CN_WANTSRSRCFORK) {
1365 error = ENOENT;
1366 goto bad;
1367 }
1368#endif
1369
1370 error = lookup_validate_creation_path(ndp);
1371 if (error) {
1372 goto bad;
1373 }
1374 /*
1375 * We return with ni_vp NULL to indicate that the entry
1376 * doesn't currently exist, leaving a pointer to the
1377 * referenced directory vnode in ndp->ni_dvp.
1378 */
1379 if (cnp->cn_flags & SAVESTART) {
1380 if ((vnode_get(ndp->ni_dvp))) {
1381 error = ENOENT;
1382 goto bad;
1383 }
1384 ndp->ni_startdir = ndp->ni_dvp;
1385 }
1386 if (!wantparent) {
1387 vnode_put(vp: ndp->ni_dvp);
1388 }
1389
1390 if (kdebug_enable) {
1391 kdebug_lookup(dp: ndp->ni_dvp, cnp);
1392 }
1393 return 0;
1394 }
1395returned_from_lookup_path:
1396 /* We'll always have an iocount on ni_vp when this finishes. */
1397 error = lookup_handle_found_vnode(ndp, cnp, rdonly, vbusyflags, keep_going: &keep_going, nc_generation, wantparent, atroot, ctx);
1398 if (error != 0) {
1399 goto bad2;
1400 }
1401
1402 if (keep_going) {
1403 dp = ndp->ni_vp;
1404
1405 /* namei() will handle symlinks */
1406 if ((dp->v_type == VLNK) &&
1407 ((cnp->cn_flags & FOLLOW) || (ndp->ni_flag & NAMEI_TRAILINGSLASH) || *ndp->ni_next == '/')) {
1408 return 0;
1409 }
1410
1411 /*
1412 * Otherwise, there's more path to process.
1413 * cache_lookup_path is now responsible for dropping io ref on dp
1414 * when it is called again in the dirloop. This ensures we hold
1415 * a ref on dp until we complete the next round of lookup.
1416 */
1417 last_dp = dp;
1418
1419 goto dirloop;
1420 }
1421
1422 return 0;
1423bad2:
1424 if (ndp->ni_dvp) {
1425 vnode_put(vp: ndp->ni_dvp);
1426 }
1427
1428 vnode_put(vp: ndp->ni_vp);
1429 ndp->ni_vp = NULLVP;
1430
1431 if (kdebug_enable) {
1432 kdebug_lookup(dp, cnp);
1433 }
1434 return error;
1435
1436bad:
1437 if (dp) {
1438 vnode_put(vp: dp);
1439 }
1440 ndp->ni_vp = NULLVP;
1441
1442 if (kdebug_enable) {
1443 kdebug_lookup(dp, cnp);
1444 }
1445 return error;
1446}
1447
1448#if CONFIG_UNION_MOUNTS
1449/*
1450 * Given a vnode in a union mount, traverse to the equivalent
1451 * vnode in the underlying mount.
1452 */
1453int
1454lookup_traverse_union(vnode_t dvp, vnode_t *new_dvp, vfs_context_t ctx)
1455{
1456 char *path = NULL, *pp;
1457 const char *name, *np;
1458 size_t len;
1459 int error = 0;
1460 struct nameidata nd;
1461 vnode_t vp = dvp;
1462
1463 *new_dvp = NULL;
1464
1465 if (vp && vp->v_flag & VROOT) {
1466 *new_dvp = vp->v_mount->mnt_vnodecovered;
1467 if (vnode_getwithref(vp: *new_dvp)) {
1468 return ENOENT;
1469 }
1470 return 0;
1471 }
1472
1473 path = zalloc_flags(ZV_NAMEI, Z_WAITOK | Z_NOFAIL);
1474
1475 /*
1476 * Walk back up to the mountpoint following the
1477 * v_parent chain and build a slash-separated path.
1478 * Then lookup that path starting with the covered vnode.
1479 */
1480 pp = path + (MAXPATHLEN - 1);
1481 *pp = '\0';
1482
1483 while (1) {
1484 name = vnode_getname(vp);
1485 if (name == NULL) {
1486 printf("lookup_traverse_union: null parent name: .%s\n", pp);
1487 error = ENOENT;
1488 goto done;
1489 }
1490 len = strlen(s: name);
1491 if ((len + 1) > (size_t)(pp - path)) { // Enough space for this name ?
1492 error = ENAMETOOLONG;
1493 vnode_putname(name);
1494 goto done;
1495 }
1496 for (np = name + len; len > 0; len--) { // Copy name backwards
1497 *--pp = *--np;
1498 }
1499 vnode_putname(name);
1500 vp = vp->v_parent;
1501 if (vp == NULLVP || vp->v_flag & VROOT) {
1502 break;
1503 }
1504 *--pp = '/';
1505 }
1506
1507 /* Evaluate the path in the underlying mount */
1508 NDINIT(&nd, LOOKUP, OP_LOOKUP, USEDVP, UIO_SYSSPACE, CAST_USER_ADDR_T(pp), ctx);
1509 nd.ni_dvp = dvp->v_mount->mnt_vnodecovered;
1510 error = namei(ndp: &nd);
1511 if (error == 0) {
1512 *new_dvp = nd.ni_vp;
1513 }
1514 nameidone(&nd);
1515done:
1516 if (path) {
1517 zfree(ZV_NAMEI, path);
1518 }
1519 return error;
1520}
1521#endif /* CONFIG_UNION_MOUNTS */
1522
1523int
1524lookup_validate_creation_path(struct nameidata *ndp)
1525{
1526 struct componentname *cnp = &ndp->ni_cnd;
1527
1528 /*
1529 * If creating and at end of pathname, then can consider
1530 * allowing file to be created.
1531 */
1532 if (cnp->cn_flags & RDONLY) {
1533 return EROFS;
1534 }
1535 if ((cnp->cn_flags & ISLASTCN) && (ndp->ni_flag & NAMEI_TRAILINGSLASH) && !(cnp->cn_flags & WILLBEDIR)) {
1536 return ENOENT;
1537 }
1538
1539 return 0;
1540}
1541
1542/*
1543 * Modifies only ni_vp. Always returns with ni_vp still valid (iocount held).
1544 */
1545static int
1546lookup_traverse_mountpoints(struct nameidata *ndp, struct componentname *cnp, vnode_t dp,
1547 int vbusyflags, vfs_context_t ctx)
1548{
1549 mount_t mp;
1550 vnode_t tdp;
1551 int error = 0;
1552 uint32_t depth = 0;
1553 vnode_t mounted_on_dp;
1554 int current_mount_generation = 0;
1555#if CONFIG_TRIGGERS
1556 vnode_t triggered_dp = NULLVP;
1557 int retry_cnt = 0;
1558#define MAX_TRIGGER_RETRIES 1
1559#endif
1560
1561 if (dp->v_type != VDIR || cnp->cn_flags & NOCROSSMOUNT) {
1562 return 0;
1563 }
1564
1565 mounted_on_dp = dp;
1566#if CONFIG_TRIGGERS
1567restart:
1568#endif
1569 current_mount_generation = mount_generation;
1570
1571 while (dp->v_mountedhere) {
1572 vnode_lock_spin(dp);
1573 if ((mp = dp->v_mountedhere)) {
1574 mp->mnt_crossref++;
1575 vnode_unlock(dp);
1576 } else {
1577 vnode_unlock(dp);
1578 break;
1579 }
1580
1581 if (ISSET(mp->mnt_lflag, MNT_LFORCE)) {
1582 mount_dropcrossref(mp, dp, 0);
1583 break; // don't traverse into a forced unmount
1584 }
1585
1586
1587 if (vfs_busy(mp, flags: vbusyflags)) {
1588 mount_dropcrossref(mp, dp, 0);
1589 if (vbusyflags == LK_NOWAIT) {
1590 error = ENOENT;
1591 goto out;
1592 }
1593
1594 continue;
1595 }
1596
1597 error = VFS_ROOT(mp, &tdp, ctx);
1598
1599 mount_dropcrossref(mp, dp, 0);
1600 vfs_unbusy(mp);
1601
1602 if (error) {
1603 goto out;
1604 }
1605
1606 vnode_put(vp: dp);
1607 ndp->ni_vp = dp = tdp;
1608 if (dp->v_type != VDIR) {
1609#if DEVELOPMENT || DEBUG
1610 panic("%s : Root of filesystem not a directory",
1611 __FUNCTION__);
1612#else
1613 break;
1614#endif
1615 }
1616 depth++;
1617 }
1618
1619#if CONFIG_TRIGGERS
1620 /*
1621 * The triggered_dp check here is required but is susceptible to a
1622 * (unlikely) race in which trigger mount is done from here and is
1623 * unmounted before we get past vfs_busy above. We retry to deal with
1624 * that case but it has the side effect of unwanted retries for
1625 * "special" processes which don't want to trigger mounts.
1626 */
1627 if (dp->v_resolve && retry_cnt < MAX_TRIGGER_RETRIES) {
1628 error = vnode_trigger_resolve(dp, ndp, ctx);
1629 if (error) {
1630 goto out;
1631 }
1632 if (dp == triggered_dp) {
1633 retry_cnt += 1;
1634 } else {
1635 retry_cnt = 0;
1636 }
1637 triggered_dp = dp;
1638 goto restart;
1639 }
1640#endif /* CONFIG_TRIGGERS */
1641
1642 if (depth) {
1643 mp = mounted_on_dp->v_mountedhere;
1644
1645 if (mp) {
1646 mount_lock_spin(mp);
1647 mp->mnt_realrootvp_vid = dp->v_id;
1648 mp->mnt_realrootvp = dp;
1649 mp->mnt_generation = current_mount_generation;
1650 mount_unlock(mp);
1651 }
1652 }
1653
1654 return 0;
1655
1656out:
1657 return error;
1658}
1659
1660/*
1661 * Takes ni_vp and ni_dvp non-NULL. Returns with *new_dp set to the location
1662 * at which to start a lookup with a resolved path, and all other iocounts dropped.
1663 */
1664static int
1665lookup_handle_symlink(struct nameidata *ndp, vnode_t *new_dp, bool *new_dp_has_iocount, vfs_context_t ctx)
1666{
1667 int error;
1668 char *cp; /* pointer into pathname argument */
1669 uio_t auio;
1670 UIO_STACKBUF(uio_buf, 1);
1671 int need_newpathbuf;
1672 u_int linklen = 0;
1673 struct componentname *cnp = &ndp->ni_cnd;
1674 vnode_t dp;
1675 char *tmppn;
1676 u_int rsrclen = (cnp->cn_flags & CN_WANTSRSRCFORK) ? sizeof(_PATH_RSRCFORKSPEC) : 0;
1677 bool dp_has_iocount = false;
1678
1679 if (ndp->ni_loopcnt++ >= MAXSYMLINKS) {
1680 return ELOOP;
1681 }
1682#if CONFIG_MACF
1683 if ((error = mac_vnode_check_readlink(ctx, vp: ndp->ni_vp)) != 0) {
1684 return error;
1685 }
1686#endif /* MAC */
1687 if (ndp->ni_pathlen > 1 || !(cnp->cn_flags & HASBUF)) {
1688 need_newpathbuf = 1;
1689 } else {
1690 need_newpathbuf = 0;
1691 }
1692
1693 if (need_newpathbuf) {
1694 cp = zalloc(view: ZV_NAMEI);
1695 } else {
1696 cp = cnp->cn_pnbuf;
1697 }
1698 auio = uio_createwithbuffer(a_iovcount: 1, a_offset: 0, a_spacetype: UIO_SYSSPACE, a_iodirection: UIO_READ, a_buf_p: &uio_buf[0], a_buffer_size: sizeof(uio_buf));
1699
1700 uio_addiov(a_uio: auio, CAST_USER_ADDR_T(cp), MAXPATHLEN);
1701
1702 error = VNOP_READLINK(ndp->ni_vp, auio, ctx);
1703
1704 if (!error) {
1705 user_ssize_t resid = uio_resid(a_uio: auio);
1706
1707 assert(resid <= MAXPATHLEN);
1708
1709 if (resid == MAXPATHLEN) {
1710 linklen = 0;
1711 } else {
1712 /*
1713 * Safe to set unsigned with a [larger] signed type here
1714 * because 0 <= uio_resid <= MAXPATHLEN and MAXPATHLEN
1715 * is only 1024.
1716 */
1717 linklen = (u_int)strnlen(s: cp, MAXPATHLEN - (u_int)resid);
1718 }
1719
1720 if (linklen == 0) {
1721 error = ENOENT;
1722 } else if (linklen + ndp->ni_pathlen + rsrclen > MAXPATHLEN) {
1723 error = ENAMETOOLONG;
1724 }
1725 }
1726
1727 if (error) {
1728 if (need_newpathbuf) {
1729 zfree(ZV_NAMEI, cp);
1730 }
1731 return error;
1732 }
1733
1734 if (need_newpathbuf) {
1735 tmppn = cnp->cn_pnbuf;
1736 bcopy(src: ndp->ni_next, dst: cp + linklen, n: ndp->ni_pathlen);
1737 cnp->cn_pnbuf = cp;
1738 cnp->cn_pnlen = MAXPATHLEN;
1739
1740 if ((cnp->cn_flags & HASBUF)) {
1741 zfree(ZV_NAMEI, tmppn);
1742 } else {
1743 cnp->cn_flags |= HASBUF;
1744 }
1745 } else {
1746 cnp->cn_pnbuf[linklen] = '\0';
1747 }
1748
1749 ndp->ni_pathlen += linklen;
1750 cnp->cn_nameptr = cnp->cn_pnbuf;
1751
1752 /*
1753 * starting point for 'relative'
1754 * symbolic link path
1755 */
1756 dp = ndp->ni_dvp;
1757
1758 /*
1759 * get rid of reference returned via 'lookup'
1760 * ni_dvp is released only if we restart at /.
1761 */
1762 vnode_put(vp: ndp->ni_vp);
1763 ndp->ni_vp = NULLVP;
1764 ndp->ni_dvp = NULLVP;
1765
1766 dp_has_iocount = true;
1767
1768 /*
1769 * Check if symbolic link restarts us at the root
1770 */
1771 if (*(cnp->cn_nameptr) == '/') {
1772 while (*(cnp->cn_nameptr) == '/') {
1773 cnp->cn_nameptr++;
1774 ndp->ni_pathlen--;
1775 }
1776 if (linklen != 0) {
1777 vnode_put(vp: dp); /* ALWAYS have a dvp for a symlink */
1778 dp_has_iocount = false;
1779 if ((dp = ndp->ni_rootdir) == NULLVP) {
1780 return ENOENT;
1781 }
1782 }
1783 }
1784
1785 *new_dp = dp;
1786 *new_dp_has_iocount = dp_has_iocount;
1787
1788 return 0;
1789}
1790
1791/*
1792 * relookup - lookup a path name component
1793 * Used by lookup to re-aquire things.
1794 */
1795int
1796relookup(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp)
1797{
1798 struct vnode *dp = NULL; /* the directory we are searching */
1799 int wantparent; /* 1 => wantparent or lockparent flag */
1800 int rdonly; /* lookup read-only flag bit */
1801 int error = 0;
1802#ifdef NAMEI_DIAGNOSTIC
1803 int i, newhash; /* DEBUG: check name hash */
1804 char *cp; /* DEBUG: check name ptr/len */
1805#endif
1806 vfs_context_t ctx = cnp->cn_context;
1807
1808 /*
1809 * Setup: break out flag bits into variables.
1810 */
1811 wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT);
1812 rdonly = cnp->cn_flags & RDONLY;
1813 cnp->cn_flags &= ~ISSYMLINK;
1814
1815 if (cnp->cn_flags & NOCACHE) {
1816 cnp->cn_flags &= ~MAKEENTRY;
1817 } else {
1818 cnp->cn_flags |= MAKEENTRY;
1819 }
1820
1821 dp = dvp;
1822
1823 /*
1824 * Check for degenerate name (e.g. / or "")
1825 * which is a way of talking about a directory,
1826 * e.g. like "/." or ".".
1827 */
1828 if (cnp->cn_nameptr[0] == '\0') {
1829 if (cnp->cn_nameiop != LOOKUP || wantparent) {
1830 error = EISDIR;
1831 goto bad;
1832 }
1833 if (dp->v_type != VDIR) {
1834 error = ENOTDIR;
1835 goto bad;
1836 }
1837 if ((vnode_get(dp))) {
1838 error = ENOENT;
1839 goto bad;
1840 }
1841 *vpp = dp;
1842
1843 if (cnp->cn_flags & SAVESTART) {
1844 panic("lookup: SAVESTART");
1845 }
1846 return 0;
1847 }
1848 /*
1849 * We now have a segment name to search for, and a directory to search.
1850 */
1851 if ((error = VNOP_LOOKUP(dp, vpp, cnp, ctx))) {
1852 if (error != EJUSTRETURN) {
1853 goto bad;
1854 }
1855#if DIAGNOSTIC
1856 if (*vpp != NULL) {
1857 panic("leaf should be empty");
1858 }
1859#endif
1860 /*
1861 * If creating and at end of pathname, then can consider
1862 * allowing file to be created.
1863 */
1864 if (rdonly) {
1865 error = EROFS;
1866 goto bad;
1867 }
1868 /*
1869 * We return with ni_vp NULL to indicate that the entry
1870 * doesn't currently exist, leaving a pointer to the
1871 * (possibly locked) directory inode in ndp->ni_dvp.
1872 */
1873 return 0;
1874 }
1875 dp = *vpp;
1876
1877#if DIAGNOSTIC
1878 /*
1879 * Check for symbolic link
1880 */
1881 if (dp->v_type == VLNK && (cnp->cn_flags & FOLLOW)) {
1882 panic("relookup: symlink found.");
1883 }
1884#endif
1885
1886 /*
1887 * Disallow directory write attempts on read-only file systems.
1888 */
1889 if (rdonly &&
1890 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) {
1891 error = EROFS;
1892 goto bad2;
1893 }
1894 /* ASSERT(dvp == ndp->ni_startdir) */
1895
1896 return 0;
1897
1898bad2:
1899 vnode_put(vp: dp);
1900bad:
1901 *vpp = NULL;
1902
1903 return error;
1904}
1905
1906/*
1907 * Free pathname buffer
1908 */
1909void
1910nameidone(struct nameidata *ndp)
1911{
1912 if (ndp->ni_cnd.cn_flags & HASBUF) {
1913 char *tmp = ndp->ni_cnd.cn_pnbuf;
1914
1915 ndp->ni_cnd.cn_pnbuf = NULL;
1916 ndp->ni_cnd.cn_flags &= ~HASBUF;
1917 zfree(ZV_NAMEI, tmp);
1918 }
1919}
1920
1921
1922/*
1923 * Log (part of) a pathname using kdebug, as used by fs_usage. The path up to
1924 * and including the current component name are logged. Up to NUMPARMS * 4
1925 * bytes of pathname will be logged. If the path to be logged is longer than
1926 * that, then the last NUMPARMS * 4 bytes are logged. That is, the truncation
1927 * removes the leading portion of the path.
1928 *
1929 * The logging is done via multiple KDBG_RELEASE calls. The first one is marked
1930 * with DBG_FUNC_START. The last one is marked with DBG_FUNC_END (in addition
1931 * to DBG_FUNC_START if it is also the first). There may be intermediate ones
1932 * with neither DBG_FUNC_START nor DBG_FUNC_END.
1933 *
1934 * The first event passes the vnode pointer and 24 or 32 (on K32, 12 or 24)
1935 * bytes of pathname. The remaining events add 32 (on K32, 16) bytes of
1936 * pathname each. The minimum number of events required to pass the path are
1937 * used. Any excess padding in the final event (because not all of the 24 or 32
1938 * (on K32, 12 or 16) bytes are needed for the remainder of the path) is set to
1939 * zero bytes, or '>' if there is more path beyond the current component name
1940 * (usually because an intermediate component was not found).
1941 *
1942 * NOTE: If the path length is greater than NUMPARMS * 4, or is not of the form
1943 * 24 + N * 32 (or on K32, 12 + N * 16), there will be no padding.
1944 */
1945#if (KDEBUG_LEVEL >= KDEBUG_LEVEL_IST)
1946
1947void
1948kdebug_vfs_lookup(unsigned long *path_words, int path_len, void *vnp,
1949 uint32_t flags)
1950{
1951 bool noprocfilt = flags & KDBG_VFS_LOOKUP_FLAG_NOPROCFILT;
1952
1953 assert(path_len >= 0);
1954
1955 int code = ((flags & KDBG_VFS_LOOKUP_FLAG_LOOKUP) ? VFS_LOOKUP :
1956 VFS_LOOKUP_DONE) | DBG_FUNC_START;
1957
1958 if (path_len <= (3 * (int)sizeof(long))) {
1959 code |= DBG_FUNC_END;
1960 }
1961
1962 if (noprocfilt) {
1963 KDBG_RELEASE_NOPROCFILT(code, kdebug_vnode(vnp), path_words[0],
1964 path_words[1], path_words[2]);
1965 } else {
1966 KDBG_RELEASE(code, kdebug_vnode(vnp), path_words[0], path_words[1],
1967 path_words[2]);
1968 }
1969
1970 code &= ~DBG_FUNC_START;
1971
1972 for (int i = 3; i * (int)sizeof(long) < path_len; i += 4) {
1973 if ((i + 4) * (int)sizeof(long) >= path_len) {
1974 code |= DBG_FUNC_END;
1975 }
1976
1977 if (noprocfilt) {
1978 KDBG_RELEASE_NOPROCFILT(code, path_words[i], path_words[i + 1],
1979 path_words[i + 2], path_words[i + 3]);
1980 } else {
1981 KDBG_RELEASE(code, path_words[i], path_words[i + 1],
1982 path_words[i + 2], path_words[i + 3]);
1983 }
1984 }
1985}
1986
1987void
1988kdebug_lookup_gen_events(long *path_words, int path_len, void *vnp, bool lookup)
1989{
1990 assert(path_len >= 0);
1991 kdebug_vfs_lookup(path_words: (unsigned long *)path_words, path_len, vnp,
1992 flags: lookup ? KDBG_VFS_LOOKUP_FLAG_LOOKUP : 0);
1993}
1994
1995void
1996kdebug_lookup(vnode_t vnp, struct componentname *cnp)
1997{
1998 unsigned long path_words[NUMPARMS];
1999
2000 /*
2001 * Truncate the leading portion of the path to fit in path_words.
2002 */
2003 char *path_end = cnp->cn_nameptr + cnp->cn_namelen;
2004 size_t path_len = MIN(path_end - cnp->cn_pnbuf,
2005 (ssize_t)sizeof(path_words));
2006 assert(path_len >= 0);
2007 char *path_trunc = path_end - path_len;
2008
2009 memcpy(dst: path_words, src: path_trunc, n: path_len);
2010
2011 /*
2012 * Pad with '\0' or '>'.
2013 */
2014 if (path_len < (ssize_t)sizeof(path_words)) {
2015 bool complete_str = *(cnp->cn_nameptr + cnp->cn_namelen) == '\0';
2016 memset(s: (char *)path_words + path_len, c: complete_str ? '\0' : '>',
2017 n: sizeof(path_words) - path_len);
2018 }
2019 kdebug_vfs_lookup(path_words, path_len: (int)path_len, vnp, KDBG_VFS_LOOKUP_FLAG_LOOKUP);
2020}
2021
2022#else /* (KDEBUG_LEVEL >= KDEBUG_LEVEL_IST) */
2023
2024void
2025kdebug_vfs_lookup(long *dbg_parms __unused, int dbg_namelen __unused,
2026 void *dp __unused, __unused uint32_t flags)
2027{
2028}
2029
2030static void
2031kdebug_lookup(struct vnode *dp __unused, struct componentname *cnp __unused)
2032{
2033}
2034#endif /* (KDEBUG_LEVEL >= KDEBUG_LEVEL_IST) */
2035
2036int
2037vfs_getbyid(fsid_t *fsid, ino64_t ino, vnode_t *vpp, vfs_context_t ctx)
2038{
2039 mount_t mp;
2040 int error;
2041
2042 mp = mount_lookupby_volfsid(fsid->val[0], 1);
2043 if (mp == NULL) {
2044 return EINVAL;
2045 }
2046
2047 /* Get the target vnode. */
2048 if (ino == 2) {
2049 error = VFS_ROOT(mp, vpp, ctx);
2050 } else {
2051 error = VFS_VGET(mp, ino, vpp, ctx);
2052 }
2053
2054 vfs_unbusy(mp);
2055 return error;
2056}
2057/*
2058 * Obtain the real path from a legacy volfs style path.
2059 *
2060 * Valid formats of input path:
2061 *
2062 * "555/@"
2063 * "555/2"
2064 * "555/123456"
2065 * "555/123456/foobar"
2066 *
2067 * Where:
2068 * 555 represents the volfs file system id
2069 * '@' and '2' are aliases to the root of a file system
2070 * 123456 represents a file id
2071 * "foobar" represents a file name
2072 */
2073#if CONFIG_VOLFS
2074static int
2075vfs_getrealpath(const char * path, char * realpath, size_t bufsize, vfs_context_t ctx)
2076{
2077 vnode_t vp;
2078 struct mount *mp = NULL;
2079 char *str;
2080 char ch;
2081 unsigned long id;
2082 ino64_t ino;
2083 int error;
2084 int length;
2085
2086 /* Get file system id and move str to next component. */
2087 id = strtoul(path, &str, 10);
2088 if (id == 0 || str[0] != '/') {
2089 return EINVAL;
2090 }
2091 while (*str == '/') {
2092 str++;
2093 }
2094 ch = *str;
2095
2096 if (id > INT_MAX) {
2097 return ENOENT;
2098 }
2099 mp = mount_lookupby_volfsid((int)id, 1);
2100 if (mp == NULL) {
2101 return EINVAL; /* unexpected failure */
2102 }
2103 /* Check for an alias to a file system root. */
2104 if (ch == '@' && str[1] == '\0') {
2105 ino = 2;
2106 str++;
2107 } else {
2108 /* Get file id and move str to next component. */
2109 ino = strtouq(str, &str, 10);
2110 }
2111
2112 /* Get the target vnode. */
2113 if (ino == 2) {
2114 struct vfs_attr vfsattr;
2115 int use_vfs_root = TRUE;
2116
2117 VFSATTR_INIT(&vfsattr);
2118 VFSATTR_WANTED(&vfsattr, f_capabilities);
2119 if (vfs_getattr(mp, vfa: &vfsattr, ctx: vfs_context_kernel()) == 0 &&
2120 VFSATTR_IS_SUPPORTED(&vfsattr, f_capabilities)) {
2121 if ((vfsattr.f_capabilities.capabilities[VOL_CAPABILITIES_FORMAT] & VOL_CAP_FMT_VOL_GROUPS) &&
2122 (vfsattr.f_capabilities.valid[VOL_CAPABILITIES_FORMAT] & VOL_CAP_FMT_VOL_GROUPS)) {
2123 use_vfs_root = FALSE;
2124 }
2125 }
2126
2127 if (use_vfs_root) {
2128 error = VFS_ROOT(mp, &vp, ctx);
2129 } else {
2130 error = VFS_VGET(mp, ino, &vp, ctx);
2131 }
2132 } else {
2133 error = VFS_VGET(mp, ino, &vp, ctx);
2134 }
2135 vfs_unbusy(mp);
2136 if (error) {
2137 goto out;
2138 }
2139 realpath[0] = '\0';
2140
2141 /* Get the absolute path to this vnode. */
2142 error = build_path(first_vp: vp, buff: realpath, buflen: (int)bufsize, outlen: &length, flags: 0, ctx);
2143 vnode_put(vp);
2144
2145 if (error == 0 && *str != '\0') {
2146 size_t attempt = strlcat(dst: realpath, src: str, MAXPATHLEN);
2147 if (attempt > MAXPATHLEN) {
2148 error = ENAMETOOLONG;
2149 }
2150 }
2151out:
2152 return error;
2153}
2154#endif
2155
2156void
2157lookup_compound_vnop_post_hook(int error, vnode_t dvp, vnode_t vp, struct nameidata *ndp, int did_create)
2158{
2159 if (error == 0 && vp == NULLVP) {
2160 panic("NULL vp with error == 0.");
2161 }
2162
2163 /*
2164 * We don't want to do any of this if we didn't use the compound vnop
2165 * to perform the lookup... i.e. if we're allowing and using the legacy pattern,
2166 * where we did a full lookup.
2167 */
2168 if ((ndp->ni_flag & NAMEI_COMPOUND_OP_MASK) == 0) {
2169 return;
2170 }
2171
2172 /*
2173 * If we're going to continue the lookup, we'll handle
2174 * all lookup-related updates at that time.
2175 */
2176 if (error == EKEEPLOOKING) {
2177 return;
2178 }
2179
2180 /*
2181 * Only audit or update cache for *found* vnodes. For creation
2182 * neither would happen in the non-compound-vnop case.
2183 */
2184 if ((vp != NULLVP) && !did_create) {
2185 /*
2186 * If MAKEENTRY isn't set, and we've done a successful compound VNOP,
2187 * then we certainly don't want to update cache or identity.
2188 */
2189 if ((error != 0) || (ndp->ni_cnd.cn_flags & MAKEENTRY)) {
2190 lookup_consider_update_cache(dvp, vp, cnp: &ndp->ni_cnd, nc_generation: ndp->ni_ncgeneration);
2191 }
2192 if (ndp->ni_cnd.cn_flags & AUDITVNPATH1) {
2193 AUDIT_ARG(vnpath, vp, ARG_VNODE1);
2194 } else if (ndp->ni_cnd.cn_flags & AUDITVNPATH2) {
2195 AUDIT_ARG(vnpath, vp, ARG_VNODE2);
2196 }
2197 }
2198
2199 /*
2200 * If you created (whether you opened or not), cut a lookup tracepoint
2201 * for the parent dir (as would happen without a compound vnop). Note: we may need
2202 * a vnode despite failure in this case!
2203 *
2204 * If you did not create:
2205 * Found child (succeeded or not): cut a tracepoint for the child.
2206 * Did not find child: cut a tracepoint with the parent.
2207 */
2208 if (kdebug_enable) {
2209 kdebug_lookup(vnp: vp ? vp : dvp, cnp: &ndp->ni_cnd);
2210 }
2211}
2212