1 | /* |
2 | * Copyright (c) 2000-2015 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | /* Copyright (c) 1995 NeXT Computer, Inc. All Rights Reserved */ |
29 | /* |
30 | * Copyright (c) 1982, 1986, 1989, 1993 |
31 | * The Regents of the University of California. All rights reserved. |
32 | * (c) UNIX System Laboratories, Inc. |
33 | * All or some portions of this file are derived from material licensed |
34 | * to the University of California by American Telephone and Telegraph |
35 | * Co. or Unix System Laboratories, Inc. and are reproduced herein with |
36 | * the permission of UNIX System Laboratories, Inc. |
37 | * |
38 | * Redistribution and use in source and binary forms, with or without |
39 | * modification, are permitted provided that the following conditions |
40 | * are met: |
41 | * 1. Redistributions of source code must retain the above copyright |
42 | * notice, this list of conditions and the following disclaimer. |
43 | * 2. Redistributions in binary form must reproduce the above copyright |
44 | * notice, this list of conditions and the following disclaimer in the |
45 | * documentation and/or other materials provided with the distribution. |
46 | * 3. All advertising materials mentioning features or use of this software |
47 | * must display the following acknowledgement: |
48 | * This product includes software developed by the University of |
49 | * California, Berkeley and its contributors. |
50 | * 4. Neither the name of the University nor the names of its contributors |
51 | * may be used to endorse or promote products derived from this software |
52 | * without specific prior written permission. |
53 | * |
54 | * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND |
55 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
56 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
57 | * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE |
58 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
59 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
60 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
61 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
62 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
63 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
64 | * SUCH DAMAGE. |
65 | * |
66 | * @(#)vfs_lookup.c 8.10 (Berkeley) 5/27/95 |
67 | */ |
68 | /* |
69 | * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce |
70 | * support for mandatory and extensible security protections. This notice |
71 | * is included in support of clause 2.2 (b) of the Apple Public License, |
72 | * Version 2.0. |
73 | */ |
74 | |
75 | #include <sys/param.h> |
76 | #include <sys/systm.h> |
77 | #include <sys/syslimits.h> |
78 | #include <sys/time.h> |
79 | #include <sys/namei.h> |
80 | #include <sys/vm.h> |
81 | #include <sys/vnode_internal.h> |
82 | #include <sys/mount_internal.h> |
83 | #include <sys/errno.h> |
84 | #include <kern/kalloc.h> |
85 | #include <sys/filedesc.h> |
86 | #include <sys/proc_internal.h> |
87 | #include <sys/kdebug.h> |
88 | #include <sys/unistd.h> /* For _PC_NAME_MAX */ |
89 | #include <sys/uio_internal.h> |
90 | #include <sys/kauth.h> |
91 | #include <kern/zalloc.h> |
92 | #include <security/audit/audit.h> |
93 | #if CONFIG_MACF |
94 | #include <security/mac_framework.h> |
95 | #endif |
96 | #include <os/atomic_private.h> |
97 | |
98 | #include <sys/paths.h> |
99 | |
100 | #if NAMEDRSRCFORK |
101 | #include <sys/xattr.h> |
102 | #endif |
103 | /* |
104 | * The minimum volfs-style pathname is 9. |
105 | * Example: "/.vol/1/2" |
106 | */ |
107 | #define VOLFS_MIN_PATH_LEN 9 |
108 | |
109 | |
110 | #if CONFIG_VOLFS |
111 | static int vfs_getrealpath(const char * path, char * realpath, size_t bufsize, vfs_context_t ctx); |
112 | #define MAX_VOLFS_RESTARTS 5 |
113 | #endif |
114 | |
115 | static int lookup_traverse_mountpoints(struct nameidata *ndp, struct componentname *cnp, vnode_t dp, int vbusyflags, vfs_context_t ctx); |
116 | static int lookup_handle_symlink(struct nameidata *ndp, vnode_t *new_dp, bool* dp_has_iocount, vfs_context_t ctx); |
117 | static int lookup_authorize_search(vnode_t dp, struct componentname *cnp, int dp_authorized_in_cache, vfs_context_t ctx); |
118 | static void lookup_consider_update_cache(vnode_t dvp, vnode_t vp, struct componentname *cnp, int nc_generation); |
119 | static int lookup_handle_found_vnode(struct nameidata *ndp, struct componentname *cnp, int rdonly, |
120 | int vbusyflags, int *keep_going, int nc_generation, |
121 | int wantparent, int atroot, vfs_context_t ctx); |
122 | static int lookup_handle_emptyname(struct nameidata *ndp, struct componentname *cnp, int wantparent); |
123 | |
124 | #if NAMEDRSRCFORK |
125 | static int lookup_handle_rsrc_fork(vnode_t dp, struct nameidata *ndp, struct componentname *cnp, int wantparent, vfs_context_t ctx); |
126 | #endif |
127 | |
128 | extern lck_rw_t rootvnode_rw_lock; |
129 | |
130 | /* |
131 | * Convert a pathname into a pointer to a locked inode. |
132 | * |
133 | * The FOLLOW flag is set when symbolic links are to be followed |
134 | * when they occur at the end of the name translation process. |
135 | * Symbolic links are always followed for all other pathname |
136 | * components other than the last. |
137 | * |
138 | * The segflg defines whether the name is to be copied from user |
139 | * space or kernel space. |
140 | * |
141 | * Overall outline of namei: |
142 | * |
143 | * copy in name |
144 | * get starting directory |
145 | * while (!done && !error) { |
146 | * call lookup to search path. |
147 | * if symbolic link, massage name in buffer and continue |
148 | * } |
149 | * |
150 | * Returns: 0 Success |
151 | * ENOENT No such file or directory |
152 | * ELOOP Too many levels of symbolic links |
153 | * ENAMETOOLONG Filename too long |
154 | * copyinstr:EFAULT Bad address |
155 | * copyinstr:ENAMETOOLONG Filename too long |
156 | * lookup:EBADF Bad file descriptor |
157 | * lookup:EROFS |
158 | * lookup:EACCES |
159 | * lookup:EPERM |
160 | * lookup:ERECYCLE vnode was recycled from underneath us in lookup. |
161 | * This means we should re-drive lookup from this point. |
162 | * lookup: ??? |
163 | * VNOP_READLINK:??? |
164 | */ |
165 | int |
166 | namei(struct nameidata *ndp) |
167 | { |
168 | struct vnode *dp; /* the directory we are searching */ |
169 | struct vnode *usedvp = ndp->ni_dvp; /* store pointer to vp in case we must loop due to |
170 | * heavy vnode pressure */ |
171 | uint32_t cnpflags = ndp->ni_cnd.cn_flags; /* store in case we have to restore after loop */ |
172 | int error; |
173 | struct componentname *cnp = &ndp->ni_cnd; |
174 | vfs_context_t ctx = cnp->cn_context; |
175 | proc_t p = vfs_context_proc(ctx); |
176 | #if CONFIG_AUDIT |
177 | /* XXX ut should be from context */ |
178 | uthread_t ut = current_uthread(); |
179 | #endif |
180 | |
181 | #if CONFIG_VOLFS |
182 | int volfs_restarts = 0; |
183 | #endif |
184 | size_t bytes_copied = 0; |
185 | vnode_t rootdir_with_usecount = NULLVP; |
186 | vnode_t startdir_with_usecount = NULLVP; |
187 | vnode_t usedvp_dp = NULLVP; |
188 | int32_t old_count = 0; |
189 | bool dp_has_iocount = false; |
190 | |
191 | #if DIAGNOSTIC |
192 | if (!vfs_context_ucred(ctx) || !p) { |
193 | panic("namei: bad cred/proc" ); |
194 | } |
195 | if (cnp->cn_nameiop & (~OPMASK)) { |
196 | panic("namei: nameiop contaminated with flags" ); |
197 | } |
198 | if (cnp->cn_flags & OPMASK) { |
199 | panic("namei: flags contaminated with nameiops" ); |
200 | } |
201 | #endif |
202 | |
203 | /* |
204 | * A compound VNOP found something that needs further processing: |
205 | * either a trigger vnode, a covered directory, or a symlink. |
206 | */ |
207 | if (ndp->ni_flag & NAMEI_CONTLOOKUP) { |
208 | int rdonly, vbusyflags, keep_going, wantparent; |
209 | |
210 | rdonly = cnp->cn_flags & RDONLY; |
211 | vbusyflags = ((cnp->cn_flags & CN_NBMOUNTLOOK) != 0) ? LK_NOWAIT : 0; |
212 | keep_going = 0; |
213 | wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT); |
214 | |
215 | ndp->ni_flag &= ~(NAMEI_CONTLOOKUP); |
216 | |
217 | error = lookup_handle_found_vnode(ndp, cnp: &ndp->ni_cnd, rdonly, vbusyflags, |
218 | keep_going: &keep_going, nc_generation: ndp->ni_ncgeneration, wantparent, atroot: 0, ctx); |
219 | if (error) { |
220 | goto out_drop; |
221 | } |
222 | if (keep_going) { |
223 | if ((cnp->cn_flags & ISSYMLINK) == 0) { |
224 | panic("We need to keep going on a continued lookup, but for vp type %d (tag %d)" , ndp->ni_vp->v_type, ndp->ni_vp->v_tag); |
225 | } |
226 | goto continue_symlink; |
227 | } |
228 | |
229 | return 0; |
230 | } |
231 | |
232 | vnode_recycled: |
233 | |
234 | /* |
235 | * Get a buffer for the name to be translated, and copy the |
236 | * name into the buffer. |
237 | */ |
238 | if ((cnp->cn_flags & HASBUF) == 0) { |
239 | cnp->cn_pnbuf = ndp->ni_pathbuf; |
240 | cnp->cn_pnlen = PATHBUFLEN; |
241 | } |
242 | |
243 | retry_copy: |
244 | if (UIO_SEG_IS_USER_SPACE(ndp->ni_segflg)) { |
245 | error = copyinstr(uaddr: ndp->ni_dirp, kaddr: cnp->cn_pnbuf, |
246 | len: cnp->cn_pnlen, done: &bytes_copied); |
247 | } else { |
248 | error = copystr(CAST_DOWN(void *, ndp->ni_dirp), kdaddr: cnp->cn_pnbuf, |
249 | len: cnp->cn_pnlen, done: &bytes_copied); |
250 | } |
251 | if (error == ENAMETOOLONG && !(cnp->cn_flags & HASBUF)) { |
252 | cnp->cn_pnbuf = zalloc(view: ZV_NAMEI); |
253 | cnp->cn_flags |= HASBUF; |
254 | cnp->cn_pnlen = MAXPATHLEN; |
255 | bytes_copied = 0; |
256 | |
257 | goto retry_copy; |
258 | } |
259 | if (error) { |
260 | goto error_out; |
261 | } |
262 | assert(bytes_copied <= MAXPATHLEN); |
263 | ndp->ni_pathlen = (u_int)bytes_copied; |
264 | bytes_copied = 0; |
265 | |
266 | /* |
267 | * Since the name cache may contain positive entries of |
268 | * the incorrect case, force lookup() to bypass the cache |
269 | * and call directly into the filesystem for each path |
270 | * component. Note: the FS may still consult the cache, |
271 | * but can apply rules to validate the results. |
272 | */ |
273 | if (proc_is_forcing_hfs_case_sensitivity(p)) { |
274 | cnp->cn_flags |= CN_SKIPNAMECACHE; |
275 | } |
276 | |
277 | #if CONFIG_VOLFS |
278 | /* |
279 | * Check for legacy volfs style pathnames. |
280 | * |
281 | * For compatibility reasons we currently allow these paths, |
282 | * but future versions of the OS may not support them. |
283 | */ |
284 | if (ndp->ni_pathlen >= VOLFS_MIN_PATH_LEN && |
285 | cnp->cn_pnbuf[0] == '/' && |
286 | cnp->cn_pnbuf[1] == '.' && |
287 | cnp->cn_pnbuf[2] == 'v' && |
288 | cnp->cn_pnbuf[3] == 'o' && |
289 | cnp->cn_pnbuf[4] == 'l' && |
290 | cnp->cn_pnbuf[5] == '/') { |
291 | char * realpath; |
292 | int realpath_err; |
293 | /* Attempt to resolve a legacy volfs style pathname. */ |
294 | realpath = zalloc(view: ZV_NAMEI); |
295 | /* |
296 | * We only error out on the ENAMETOOLONG cases where we know that |
297 | * vfs_getrealpath translation succeeded but the path could not fit into |
298 | * MAXPATHLEN characters. In other failure cases, we may be dealing with a path |
299 | * that legitimately looks like /.vol/1234/567 and is not meant to be translated |
300 | */ |
301 | if ((realpath_err = vfs_getrealpath(path: &cnp->cn_pnbuf[6], realpath, MAXPATHLEN, ctx))) { |
302 | zfree(ZV_NAMEI, realpath); |
303 | if (realpath_err == ENOSPC || realpath_err == ENAMETOOLONG) { |
304 | error = ENAMETOOLONG; |
305 | goto error_out; |
306 | } |
307 | } else { |
308 | size_t tmp_len; |
309 | if (cnp->cn_flags & HASBUF) { |
310 | zfree(ZV_NAMEI, cnp->cn_pnbuf); |
311 | } |
312 | cnp->cn_pnbuf = realpath; |
313 | cnp->cn_pnlen = MAXPATHLEN; |
314 | tmp_len = strlen(s: realpath) + 1; |
315 | assert(tmp_len <= UINT_MAX); |
316 | ndp->ni_pathlen = (u_int)tmp_len; |
317 | cnp->cn_flags |= HASBUF | CN_VOLFSPATH; |
318 | } |
319 | } |
320 | #endif /* CONFIG_VOLFS */ |
321 | |
322 | #if CONFIG_AUDIT |
323 | /* If we are auditing the kernel pathname, save the user pathname */ |
324 | if (cnp->cn_flags & AUDITVNPATH1) { |
325 | AUDIT_ARG(upath, ut->uu_cdir, cnp->cn_pnbuf, ARG_UPATH1); |
326 | } |
327 | if (cnp->cn_flags & AUDITVNPATH2) { |
328 | AUDIT_ARG(upath, ut->uu_cdir, cnp->cn_pnbuf, ARG_UPATH2); |
329 | } |
330 | #endif /* CONFIG_AUDIT */ |
331 | |
332 | /* |
333 | * Do not allow empty pathnames |
334 | */ |
335 | if (*cnp->cn_pnbuf == '\0') { |
336 | error = ENOENT; |
337 | goto error_out; |
338 | } |
339 | if (ndp->ni_flag & NAMEI_NOFOLLOW_ANY) { |
340 | ndp->ni_loopcnt = MAXSYMLINKS; |
341 | } else { |
342 | ndp->ni_loopcnt = 0; |
343 | } |
344 | |
345 | /* |
346 | * determine the starting point for the translation. |
347 | */ |
348 | proc_dirs_lock_shared(p); |
349 | lck_rw_lock_shared(lck: &rootvnode_rw_lock); |
350 | |
351 | if (!(ndp->ni_flag & NAMEI_ROOTDIR)) { |
352 | if (fdt_flag_test(&p->p_fd, FD_CHROOT)) { |
353 | ndp->ni_rootdir = p->p_fd.fd_rdir; |
354 | } else { |
355 | ndp->ni_rootdir = rootvnode; |
356 | } |
357 | } |
358 | |
359 | if (!ndp->ni_rootdir) { |
360 | if (ndp->ni_flag & NAMEI_ROOTDIR) { |
361 | panic("NAMEI_ROOTDIR is set but ni_rootdir is not\n" ); |
362 | } else if (fdt_flag_test(&p->p_fd, FD_CHROOT)) { |
363 | /* This should be a panic */ |
364 | printf("p->p_fd.fd_rdir is not set\n" ); |
365 | } else { |
366 | printf("rootvnode is not set\n" ); |
367 | } |
368 | lck_rw_unlock_shared(lck: &rootvnode_rw_lock); |
369 | proc_dirs_unlock_shared(p); |
370 | error = ENOENT; |
371 | goto error_out; |
372 | } |
373 | |
374 | cnp->cn_nameptr = cnp->cn_pnbuf; |
375 | |
376 | ndp->ni_usedvp = NULLVP; |
377 | |
378 | if (*(cnp->cn_nameptr) == '/') { |
379 | while (*(cnp->cn_nameptr) == '/') { |
380 | cnp->cn_nameptr++; |
381 | ndp->ni_pathlen--; |
382 | } |
383 | dp = ndp->ni_rootdir; |
384 | } else if (cnp->cn_flags & USEDVP) { |
385 | dp = ndp->ni_dvp; |
386 | ndp->ni_usedvp = dp; |
387 | usedvp_dp = dp; |
388 | } else { |
389 | dp = vfs_context_cwd(ctx); |
390 | } |
391 | |
392 | if (dp == NULLVP || (dp->v_lflag & VL_DEAD)) { |
393 | dp = NULLVP; |
394 | lck_rw_unlock_shared(lck: &rootvnode_rw_lock); |
395 | proc_dirs_unlock_shared(p); |
396 | error = ENOENT; |
397 | goto error_out; |
398 | } |
399 | |
400 | /* |
401 | * We need our own usecount on the root vnode and the starting dir across |
402 | * the lookup. There's two things that be done here. We can hold the locks |
403 | * (which protect the existing usecounts on the directories) across the |
404 | * lookup or take our own usecount. Holding the locks across the lookup can |
405 | * cause deadlock issues if we re-enter namei on the same thread so the |
406 | * correct thing to do is to acquire our own usecount. |
407 | * |
408 | * Ideally, the usecount should be obtained by vnode_get->vnode_ref->vnode_put. |
409 | * However when this vnode is the rootvnode, that sequence will produce a |
410 | * lot of vnode mutex locks and unlocks on a single vnode (the rootvnode) |
411 | * and will be highly contended and degrade performance. Since we have |
412 | * an existing usecount protected by the locks we hold, we'll just use |
413 | * an atomic op to increment the usecount on a vnode which already has one |
414 | * and can't be released because we have the locks which protect against that |
415 | * happening. |
416 | */ |
417 | rootdir_with_usecount = ndp->ni_rootdir; |
418 | old_count = os_atomic_inc_orig(&rootdir_with_usecount->v_usecount, relaxed); |
419 | if (old_count < 1) { |
420 | panic("(1) invalid pre-increment usecount (%d) for rootdir vnode %p" , |
421 | old_count, rootdir_with_usecount); |
422 | } else if (old_count == INT32_MAX) { |
423 | panic("(1) usecount overflow for vnode %p" , rootdir_with_usecount); |
424 | } |
425 | |
426 | if ((dp != rootdir_with_usecount) && (dp != usedvp_dp)) { |
427 | old_count = os_atomic_inc_orig(&dp->v_usecount, relaxed); |
428 | if (old_count < 1) { |
429 | panic("(2) invalid pre-increment usecount (%d) for vnode %p" , old_count, dp); |
430 | } else if (old_count == INT32_MAX) { |
431 | panic("(2) usecount overflow for vnode %p" , dp); |
432 | } |
433 | startdir_with_usecount = dp; |
434 | } |
435 | |
436 | /* Now that we have our usecount, release the locks */ |
437 | lck_rw_unlock_shared(lck: &rootvnode_rw_lock); |
438 | proc_dirs_unlock_shared(p); |
439 | |
440 | ndp->ni_dvp = NULLVP; |
441 | ndp->ni_vp = NULLVP; |
442 | |
443 | for (;;) { |
444 | #if CONFIG_MACF |
445 | /* |
446 | * Give MACF policies a chance to reject the lookup |
447 | * before performing any filesystem operations. |
448 | * This hook is called before resolving the path and |
449 | * again each time a symlink is encountered. |
450 | * NB: policies receive path information as supplied |
451 | * by the caller and thus cannot be trusted. |
452 | */ |
453 | error = mac_vnode_check_lookup_preflight(ctx, dvp: dp, path: cnp->cn_nameptr, pathlen: cnp->cn_namelen); |
454 | if (error) { |
455 | goto error_out; |
456 | } |
457 | #endif |
458 | ndp->ni_startdir = dp; |
459 | dp = NULLVP; |
460 | |
461 | if ((error = lookup(ndp))) { |
462 | goto error_out; |
463 | } |
464 | |
465 | /* |
466 | * Check for symbolic link |
467 | */ |
468 | if ((cnp->cn_flags & ISSYMLINK) == 0) { |
469 | if (startdir_with_usecount) { |
470 | vnode_rele(vp: startdir_with_usecount); |
471 | startdir_with_usecount = NULLVP; |
472 | } |
473 | if (rootdir_with_usecount) { |
474 | lck_rw_lock_shared(lck: &rootvnode_rw_lock); |
475 | if (rootdir_with_usecount == rootvnode) { |
476 | old_count = os_atomic_dec_orig(&rootdir_with_usecount->v_usecount, relaxed); |
477 | if (old_count < 2) { |
478 | /* |
479 | * There needs to have been at least 1 usecount left on the rootvnode |
480 | */ |
481 | panic("(3) Unexpected pre-decrement value (%d) of usecount for rootvnode %p" , |
482 | old_count, rootdir_with_usecount); |
483 | } |
484 | rootdir_with_usecount = NULLVP; |
485 | } |
486 | lck_rw_unlock_shared(lck: &rootvnode_rw_lock); |
487 | if (rootdir_with_usecount) { |
488 | vnode_rele(vp: rootdir_with_usecount); |
489 | rootdir_with_usecount = NULLVP; |
490 | } |
491 | } |
492 | |
493 | return 0; |
494 | } |
495 | |
496 | continue_symlink: |
497 | /* Gives us a new path to process, and a starting dir */ |
498 | error = lookup_handle_symlink(ndp, new_dp: &dp, dp_has_iocount: &dp_has_iocount, ctx); |
499 | if (error != 0) { |
500 | break; |
501 | } |
502 | if (dp_has_iocount) { |
503 | if ((dp != rootdir_with_usecount) && (dp != startdir_with_usecount) && |
504 | (dp != usedvp_dp)) { |
505 | if (startdir_with_usecount) { |
506 | vnode_rele(vp: startdir_with_usecount); |
507 | } |
508 | vnode_ref_ext(dp, 0, VNODE_REF_FORCE); |
509 | startdir_with_usecount = dp; |
510 | } |
511 | vnode_put(vp: dp); |
512 | dp_has_iocount = false; |
513 | } |
514 | } |
515 | /* |
516 | * only come here if we fail to handle a SYMLINK... |
517 | * if either ni_dvp or ni_vp is non-NULL, then |
518 | * we need to drop the iocount that was picked |
519 | * up in the lookup routine |
520 | */ |
521 | out_drop: |
522 | if (ndp->ni_dvp) { |
523 | vnode_put(vp: ndp->ni_dvp); |
524 | } |
525 | if (ndp->ni_vp) { |
526 | vnode_put(vp: ndp->ni_vp); |
527 | } |
528 | error_out: |
529 | if (startdir_with_usecount) { |
530 | vnode_rele(vp: startdir_with_usecount); |
531 | startdir_with_usecount = NULLVP; |
532 | } |
533 | if (rootdir_with_usecount) { |
534 | lck_rw_lock_shared(lck: &rootvnode_rw_lock); |
535 | if (rootdir_with_usecount == rootvnode) { |
536 | old_count = os_atomic_dec_orig(&rootdir_with_usecount->v_usecount, relaxed); |
537 | if (old_count < 2) { |
538 | /* |
539 | * There needs to have been at least 1 usecount left on the rootvnode |
540 | */ |
541 | panic("(4) Unexpected pre-decrement value (%d) of usecount for rootvnode %p" , |
542 | old_count, rootdir_with_usecount); |
543 | } |
544 | lck_rw_unlock_shared(lck: &rootvnode_rw_lock); |
545 | } else { |
546 | lck_rw_unlock_shared(lck: &rootvnode_rw_lock); |
547 | vnode_rele(vp: rootdir_with_usecount); |
548 | } |
549 | rootdir_with_usecount = NULLVP; |
550 | } |
551 | |
552 | if ((cnp->cn_flags & HASBUF)) { |
553 | cnp->cn_flags &= ~HASBUF; |
554 | zfree(ZV_NAMEI, cnp->cn_pnbuf); |
555 | } |
556 | cnp->cn_pnbuf = NULL; |
557 | ndp->ni_vp = NULLVP; |
558 | ndp->ni_dvp = NULLVP; |
559 | |
560 | #if CONFIG_VOLFS |
561 | /* |
562 | * Deal with volfs fallout. |
563 | * |
564 | * At this point, if we were originally given a volfs path that |
565 | * looks like /.vol/123/456, then we would have had to convert it into |
566 | * a full path. Assuming that part worked properly, we will now attempt |
567 | * to conduct a lookup of the item in the namespace. Under normal |
568 | * circumstances, if a user looked up /tmp/foo and it was not there, it |
569 | * would be permissible to return ENOENT. |
570 | * |
571 | * However, we may not want to do that here. Specifically, the volfs path |
572 | * uniquely identifies a certain item in the namespace regardless of where it |
573 | * lives. If the item has moved in between the time we constructed the |
574 | * path and now, when we're trying to do a lookup/authorization on the full |
575 | * path, we may have gotten an ENOENT. |
576 | * |
577 | * At this point we can no longer tell if the path no longer exists |
578 | * or if the item in question no longer exists. It could have been renamed |
579 | * away, in which case the /.vol identifier is still valid. |
580 | * |
581 | * Do this dance a maximum of MAX_VOLFS_RESTARTS times. |
582 | */ |
583 | if ((error == ENOENT) && (ndp->ni_cnd.cn_flags & CN_VOLFSPATH)) { |
584 | if (volfs_restarts < MAX_VOLFS_RESTARTS) { |
585 | volfs_restarts++; |
586 | goto vnode_recycled; |
587 | } |
588 | } |
589 | #endif |
590 | |
591 | if (error == ERECYCLE) { |
592 | /* vnode was recycled underneath us. re-drive lookup to start at |
593 | * the beginning again, since recycling invalidated last lookup*/ |
594 | ndp->ni_cnd.cn_flags = cnpflags; |
595 | ndp->ni_dvp = usedvp; |
596 | goto vnode_recycled; |
597 | } |
598 | |
599 | |
600 | return error; |
601 | } |
602 | |
603 | int |
604 | namei_compound_available(vnode_t dp, struct nameidata *ndp) |
605 | { |
606 | if ((ndp->ni_flag & NAMEI_COMPOUNDOPEN) != 0) { |
607 | return vnode_compound_open_available(vp: dp); |
608 | } |
609 | |
610 | return 0; |
611 | } |
612 | |
613 | static int |
614 | lookup_authorize_search(vnode_t dp, struct componentname *cnp, int dp_authorized_in_cache, vfs_context_t ctx) |
615 | { |
616 | #if !CONFIG_MACF |
617 | #pragma unused(cnp) |
618 | #endif |
619 | |
620 | int error; |
621 | |
622 | if (!dp_authorized_in_cache) { |
623 | error = vnode_authorize(vp: dp, NULL, KAUTH_VNODE_SEARCH, ctx); |
624 | if (error) { |
625 | return error; |
626 | } |
627 | } |
628 | #if CONFIG_MACF |
629 | error = mac_vnode_check_lookup(ctx, dvp: dp, cnp); |
630 | if (error) { |
631 | return error; |
632 | } |
633 | #endif /* CONFIG_MACF */ |
634 | |
635 | return 0; |
636 | } |
637 | |
638 | static void |
639 | lookup_consider_update_cache(vnode_t dvp, vnode_t vp, struct componentname *cnp, int nc_generation) |
640 | { |
641 | int isdot_or_dotdot; |
642 | isdot_or_dotdot = (cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.') || (cnp->cn_flags & ISDOTDOT); |
643 | |
644 | if (vp->v_name == NULL || vp->v_parent == NULLVP) { |
645 | int update_flags = 0; |
646 | |
647 | if (isdot_or_dotdot == 0) { |
648 | if (vp->v_name == NULL) { |
649 | update_flags |= VNODE_UPDATE_NAME; |
650 | } |
651 | if (dvp != NULLVP && vp->v_parent == NULLVP) { |
652 | update_flags |= VNODE_UPDATE_PARENT; |
653 | } |
654 | |
655 | if (update_flags) { |
656 | vnode_update_identity(vp, dvp, name: cnp->cn_nameptr, name_len: cnp->cn_namelen, name_hashval: cnp->cn_hash, flags: update_flags); |
657 | } |
658 | } |
659 | } |
660 | if ((cnp->cn_flags & MAKEENTRY) && (vp->v_flag & VNCACHEABLE) && LIST_FIRST(&vp->v_nclinks) == NULL) { |
661 | /* |
662 | * missing from name cache, but should |
663 | * be in it... this can happen if volfs |
664 | * causes the vnode to be created or the |
665 | * name cache entry got recycled but the |
666 | * vnode didn't... |
667 | * check to make sure that ni_dvp is valid |
668 | * cache_lookup_path may return a NULL |
669 | * do a quick check to see if the generation of the |
670 | * directory matches our snapshot... this will get |
671 | * rechecked behind the name cache lock, but if it |
672 | * already fails to match, no need to go any further |
673 | */ |
674 | if (dvp != NULLVP && (nc_generation == dvp->v_nc_generation) && (!isdot_or_dotdot)) { |
675 | cache_enter_with_gen(dvp, vp, cnp, gen: nc_generation); |
676 | } |
677 | } |
678 | } |
679 | |
680 | #if NAMEDRSRCFORK |
681 | /* |
682 | * Can change ni_dvp and ni_vp. On success, returns with iocounts on stream vnode (always) and |
683 | * data fork if requested. On failure, returns with iocount data fork (always) and its parent directory |
684 | * (if one was provided). |
685 | */ |
686 | static int |
687 | lookup_handle_rsrc_fork(vnode_t dp, struct nameidata *ndp, struct componentname *cnp, int wantparent, vfs_context_t ctx) |
688 | { |
689 | vnode_t svp = NULLVP; |
690 | enum nsoperation nsop; |
691 | int nsflags; |
692 | int error; |
693 | |
694 | if (dp->v_type != VREG) { |
695 | error = ENOENT; |
696 | goto out; |
697 | } |
698 | switch (cnp->cn_nameiop) { |
699 | case DELETE: |
700 | if (cnp->cn_flags & CN_ALLOWRSRCFORK) { |
701 | nsop = NS_DELETE; |
702 | } else { |
703 | error = EPERM; |
704 | goto out; |
705 | } |
706 | break; |
707 | case CREATE: |
708 | if (cnp->cn_flags & CN_ALLOWRSRCFORK) { |
709 | nsop = NS_CREATE; |
710 | } else { |
711 | error = EPERM; |
712 | goto out; |
713 | } |
714 | break; |
715 | case LOOKUP: |
716 | /* Make sure our lookup of "/..namedfork/rsrc" is allowed. */ |
717 | if (cnp->cn_flags & CN_ALLOWRSRCFORK) { |
718 | nsop = NS_OPEN; |
719 | } else { |
720 | error = EPERM; |
721 | goto out; |
722 | } |
723 | break; |
724 | default: |
725 | error = EPERM; |
726 | goto out; |
727 | } |
728 | |
729 | nsflags = 0; |
730 | if (cnp->cn_flags & CN_RAW_ENCRYPTED) { |
731 | nsflags |= NS_GETRAWENCRYPTED; |
732 | } |
733 | |
734 | /* Ask the file system for the resource fork. */ |
735 | error = vnode_getnamedstream(dp, &svp, XATTR_RESOURCEFORK_NAME, nsop, nsflags, ctx); |
736 | |
737 | /* During a create, it OK for stream vnode to be missing. */ |
738 | if (error == ENOATTR || error == ENOENT) { |
739 | error = (nsop == NS_CREATE) ? 0 : ENOENT; |
740 | } |
741 | if (error) { |
742 | goto out; |
743 | } |
744 | /* The "parent" of the stream is the file. */ |
745 | if (wantparent) { |
746 | if (ndp->ni_dvp) { |
747 | vnode_put(vp: ndp->ni_dvp); |
748 | } |
749 | ndp->ni_dvp = dp; |
750 | } else { |
751 | vnode_put(vp: dp); |
752 | } |
753 | ndp->ni_vp = svp; /* on create this may be null */ |
754 | |
755 | /* Restore the truncated pathname buffer (for audits). */ |
756 | if (ndp->ni_pathlen == 1 && ndp->ni_next[0] == '\0') { |
757 | /* |
758 | * While we replaced only '/' with '\0' and would ordinarily |
759 | * need to just switch that back, the buffer in which we did |
760 | * this may not be what the pathname buffer is now when symlinks |
761 | * are involved. If we just restore the "/" we will make the |
762 | * string not terminated anymore, so be safe and restore the |
763 | * entire suffix. |
764 | */ |
765 | strncpy(ndp->ni_next, _PATH_RSRCFORKSPEC, sizeof(_PATH_RSRCFORKSPEC)); |
766 | cnp->cn_nameptr = ndp->ni_next + 1; |
767 | cnp->cn_namelen = sizeof(_PATH_RSRCFORKSPEC) - 1; |
768 | ndp->ni_next += cnp->cn_namelen; |
769 | if (ndp->ni_next[0] != '\0') { |
770 | panic("Incorrect termination of path in %s" , __FUNCTION__); |
771 | } |
772 | } |
773 | cnp->cn_flags &= ~MAKEENTRY; |
774 | |
775 | return 0; |
776 | out: |
777 | return error; |
778 | } |
779 | #endif /* NAMEDRSRCFORK */ |
780 | |
781 | /* |
782 | * iocounts in: |
783 | * --One on ni_vp. One on ni_dvp if there is more path, or we didn't come through the |
784 | * cache, or we came through the cache and the caller doesn't want the parent. |
785 | * |
786 | * iocounts out: |
787 | * --Leaves us in the correct state for the next step, whatever that might be. |
788 | * --If we find a symlink, returns with iocounts on both ni_vp and ni_dvp. |
789 | * --If we are to look up another component, then we have an iocount on ni_vp and |
790 | * nothing else. |
791 | * --If we are done, returns an iocount on ni_vp, and possibly on ni_dvp depending on nameidata flags. |
792 | * --In the event of an error, may return with ni_dvp NULL'ed out (in which case, iocount |
793 | * was dropped). |
794 | */ |
795 | static int |
796 | lookup_handle_found_vnode(struct nameidata *ndp, struct componentname *cnp, int rdonly, |
797 | int vbusyflags, int *keep_going, int nc_generation, |
798 | int wantparent, int atroot, vfs_context_t ctx) |
799 | { |
800 | vnode_t dp; |
801 | int error; |
802 | char *cp; |
803 | |
804 | dp = ndp->ni_vp; |
805 | *keep_going = 0; |
806 | |
807 | if (ndp->ni_vp == NULLVP) { |
808 | panic("NULL ni_vp in %s" , __FUNCTION__); |
809 | } |
810 | |
811 | if (atroot) { |
812 | goto nextname; |
813 | } |
814 | |
815 | /* |
816 | * Take into account any additional components consumed by |
817 | * the underlying filesystem. |
818 | */ |
819 | if (cnp->cn_consume > 0) { |
820 | cnp->cn_nameptr += cnp->cn_consume; |
821 | ndp->ni_next += cnp->cn_consume; |
822 | ndp->ni_pathlen -= cnp->cn_consume; |
823 | cnp->cn_consume = 0; |
824 | } else { |
825 | lookup_consider_update_cache(dvp: ndp->ni_dvp, vp: dp, cnp, nc_generation); |
826 | } |
827 | |
828 | /* |
829 | * Check to see if the vnode has been mounted on... |
830 | * if so find the root of the mounted file system. |
831 | * Updates ndp->ni_vp. |
832 | */ |
833 | error = lookup_traverse_mountpoints(ndp, cnp, dp, vbusyflags, ctx); |
834 | dp = ndp->ni_vp; |
835 | if (error) { |
836 | goto out; |
837 | } |
838 | |
839 | #if CONFIG_MACF |
840 | if (vfs_flags(mp: vnode_mount(vp: dp)) & MNT_MULTILABEL) { |
841 | error = vnode_label(mp: vnode_mount(vp: dp), NULL, vp: dp, NULL, flags: 0, ctx); |
842 | if (error) { |
843 | goto out; |
844 | } |
845 | } |
846 | #endif |
847 | |
848 | /* |
849 | * Check for symbolic link |
850 | */ |
851 | if ((dp->v_type == VLNK) && |
852 | ((cnp->cn_flags & FOLLOW) || (ndp->ni_flag & NAMEI_TRAILINGSLASH) || *ndp->ni_next == '/')) { |
853 | cnp->cn_flags |= ISSYMLINK; |
854 | *keep_going = 1; |
855 | return 0; |
856 | } |
857 | |
858 | /* |
859 | * Check for bogus trailing slashes. |
860 | */ |
861 | if ((ndp->ni_flag & NAMEI_TRAILINGSLASH)) { |
862 | if (dp->v_type != VDIR) { |
863 | error = ENOTDIR; |
864 | goto out; |
865 | } |
866 | ndp->ni_flag &= ~(NAMEI_TRAILINGSLASH); |
867 | } |
868 | |
869 | #if NAMEDSTREAMS |
870 | /* |
871 | * Deny namei/lookup requests to resolve paths that point to shadow files. |
872 | * Access to shadow files must be conducted by explicit calls to VNOP_LOOKUP |
873 | * directly, and not use lookup/namei |
874 | */ |
875 | if (vnode_isshadow(dp)) { |
876 | error = ENOENT; |
877 | goto out; |
878 | } |
879 | #endif |
880 | |
881 | nextname: |
882 | /* |
883 | * Not a symbolic link. If more pathname, |
884 | * continue at next component, else return. |
885 | * |
886 | * Definitely have a dvp if there's another slash |
887 | */ |
888 | if (*ndp->ni_next == '/') { |
889 | cnp->cn_nameptr = ndp->ni_next + 1; |
890 | ndp->ni_pathlen--; |
891 | while (*cnp->cn_nameptr == '/') { |
892 | cnp->cn_nameptr++; |
893 | ndp->ni_pathlen--; |
894 | } |
895 | |
896 | cp = cnp->cn_nameptr; |
897 | vnode_put(vp: ndp->ni_dvp); |
898 | ndp->ni_dvp = NULLVP; |
899 | |
900 | if (*cp == '\0') { |
901 | goto emptyname; |
902 | } |
903 | |
904 | *keep_going = 1; |
905 | return 0; |
906 | } |
907 | |
908 | /* |
909 | * Disallow directory write attempts on read-only file systems. |
910 | */ |
911 | if (rdonly && |
912 | (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { |
913 | error = EROFS; |
914 | goto out; |
915 | } |
916 | |
917 | /* If SAVESTART is set, we should have a dvp */ |
918 | if (cnp->cn_flags & SAVESTART) { |
919 | /* |
920 | * note that we already hold a reference |
921 | * on both dp and ni_dvp, but for some reason |
922 | * can't get another one... in this case we |
923 | * need to do vnode_put on dp in 'bad2' |
924 | */ |
925 | if ((vnode_get(ndp->ni_dvp))) { |
926 | error = ENOENT; |
927 | goto out; |
928 | } |
929 | ndp->ni_startdir = ndp->ni_dvp; |
930 | } |
931 | if (!wantparent && ndp->ni_dvp) { |
932 | vnode_put(vp: ndp->ni_dvp); |
933 | ndp->ni_dvp = NULLVP; |
934 | } |
935 | |
936 | if (cnp->cn_flags & AUDITVNPATH1) { |
937 | AUDIT_ARG(vnpath, dp, ARG_VNODE1); |
938 | } else if (cnp->cn_flags & AUDITVNPATH2) { |
939 | AUDIT_ARG(vnpath, dp, ARG_VNODE2); |
940 | } |
941 | |
942 | #if NAMEDRSRCFORK |
943 | /* |
944 | * Caller wants the resource fork. |
945 | */ |
946 | if ((cnp->cn_flags & CN_WANTSRSRCFORK) && (dp != NULLVP)) { |
947 | error = lookup_handle_rsrc_fork(dp, ndp, cnp, wantparent, ctx); |
948 | if (error != 0) { |
949 | goto out; |
950 | } |
951 | |
952 | dp = ndp->ni_vp; |
953 | } |
954 | #endif |
955 | if (kdebug_enable) { |
956 | kdebug_lookup(dp: ndp->ni_vp, cnp); |
957 | } |
958 | |
959 | return 0; |
960 | |
961 | emptyname: |
962 | error = lookup_handle_emptyname(ndp, cnp, wantparent); |
963 | if (error != 0) { |
964 | goto out; |
965 | } |
966 | |
967 | return 0; |
968 | out: |
969 | return error; |
970 | } |
971 | |
972 | /* |
973 | * Comes in iocount on ni_vp. May overwrite ni_dvp, but doesn't interpret incoming value. |
974 | */ |
975 | static int |
976 | lookup_handle_emptyname(struct nameidata *ndp, struct componentname *cnp, int wantparent) |
977 | { |
978 | vnode_t dp; |
979 | int error = 0; |
980 | |
981 | dp = ndp->ni_vp; |
982 | cnp->cn_namelen = 0; |
983 | /* |
984 | * A degenerate name (e.g. / or "") which is a way of |
985 | * talking about a directory, e.g. like "/." or ".". |
986 | */ |
987 | if (dp->v_type != VDIR) { |
988 | error = ENOTDIR; |
989 | goto out; |
990 | } |
991 | if (cnp->cn_nameiop == CREATE && dp == rootvnode) { |
992 | error = EEXIST; |
993 | goto out; |
994 | } |
995 | if (cnp->cn_nameiop != LOOKUP) { |
996 | error = EISDIR; |
997 | goto out; |
998 | } |
999 | if (wantparent) { |
1000 | /* |
1001 | * note that we already hold a reference |
1002 | * on dp, but for some reason can't |
1003 | * get another one... in this case we |
1004 | * need to do vnode_put on dp in 'bad' |
1005 | */ |
1006 | if ((vnode_get(dp))) { |
1007 | error = ENOENT; |
1008 | goto out; |
1009 | } |
1010 | ndp->ni_dvp = dp; |
1011 | } |
1012 | cnp->cn_flags &= ~ISDOTDOT; |
1013 | cnp->cn_flags |= ISLASTCN; |
1014 | ndp->ni_next = cnp->cn_nameptr; |
1015 | ndp->ni_vp = dp; |
1016 | |
1017 | if (cnp->cn_flags & AUDITVNPATH1) { |
1018 | AUDIT_ARG(vnpath, dp, ARG_VNODE1); |
1019 | } else if (cnp->cn_flags & AUDITVNPATH2) { |
1020 | AUDIT_ARG(vnpath, dp, ARG_VNODE2); |
1021 | } |
1022 | if (cnp->cn_flags & SAVESTART) { |
1023 | panic("lookup: SAVESTART" ); |
1024 | } |
1025 | |
1026 | return 0; |
1027 | out: |
1028 | return error; |
1029 | } |
1030 | /* |
1031 | * Search a pathname. |
1032 | * This is a very central and rather complicated routine. |
1033 | * |
1034 | * The pathname is pointed to by ni_ptr and is of length ni_pathlen. |
1035 | * The starting directory is taken from ni_startdir. The pathname is |
1036 | * descended until done, or a symbolic link is encountered. The variable |
1037 | * ni_more is clear if the path is completed; it is set to one if a |
1038 | * symbolic link needing interpretation is encountered. |
1039 | * |
1040 | * The flag argument is LOOKUP, CREATE, RENAME, or DELETE depending on |
1041 | * whether the name is to be looked up, created, renamed, or deleted. |
1042 | * When CREATE, RENAME, or DELETE is specified, information usable in |
1043 | * creating, renaming, or deleting a directory entry may be calculated. |
1044 | * If flag has LOCKPARENT or'ed into it, the parent directory is returned |
1045 | * locked. If flag has WANTPARENT or'ed into it, the parent directory is |
1046 | * returned unlocked. Otherwise the parent directory is not returned. If |
1047 | * the target of the pathname exists and LOCKLEAF is or'ed into the flag |
1048 | * the target is returned locked, otherwise it is returned unlocked. |
1049 | * When creating or renaming and LOCKPARENT is specified, the target may not |
1050 | * be ".". When deleting and LOCKPARENT is specified, the target may be ".". |
1051 | * |
1052 | * Overall outline of lookup: |
1053 | * |
1054 | * dirloop: |
1055 | * identify next component of name at ndp->ni_ptr |
1056 | * handle degenerate case where name is null string |
1057 | * if .. and crossing mount points and on mounted filesys, find parent |
1058 | * call VNOP_LOOKUP routine for next component name |
1059 | * directory vnode returned in ni_dvp, unlocked unless LOCKPARENT set |
1060 | * component vnode returned in ni_vp (if it exists), locked. |
1061 | * if result vnode is mounted on and crossing mount points, |
1062 | * find mounted on vnode |
1063 | * if more components of name, do next level at dirloop |
1064 | * return the answer in ni_vp, locked if LOCKLEAF set |
1065 | * if LOCKPARENT set, return locked parent in ni_dvp |
1066 | * if WANTPARENT set, return unlocked parent in ni_dvp |
1067 | * |
1068 | * Returns: 0 Success |
1069 | * ENOENT No such file or directory |
1070 | * EBADF Bad file descriptor |
1071 | * ENOTDIR Not a directory |
1072 | * EROFS Read-only file system [CREATE] |
1073 | * EISDIR Is a directory [CREATE] |
1074 | * cache_lookup_path:ERECYCLE (vnode was recycled from underneath us, redrive lookup again) |
1075 | * vnode_authorize:EROFS |
1076 | * vnode_authorize:EACCES |
1077 | * vnode_authorize:EPERM |
1078 | * vnode_authorize:??? |
1079 | * VNOP_LOOKUP:ENOENT No such file or directory |
1080 | * VNOP_LOOKUP:EJUSTRETURN Restart system call (INTERNAL) |
1081 | * VNOP_LOOKUP:??? |
1082 | * VFS_ROOT:ENOTSUP |
1083 | * VFS_ROOT:ENOENT |
1084 | * VFS_ROOT:??? |
1085 | */ |
1086 | int |
1087 | lookup(struct nameidata *ndp) |
1088 | { |
1089 | char *cp; /* pointer into pathname argument */ |
1090 | vnode_t tdp; /* saved dp */ |
1091 | vnode_t dp; /* the directory we are searching */ |
1092 | int docache = 1; /* == 0 do not cache last component */ |
1093 | int wantparent; /* 1 => wantparent or lockparent flag */ |
1094 | int rdonly; /* lookup read-only flag bit */ |
1095 | int dp_authorized = 0; |
1096 | int error = 0; |
1097 | struct componentname *cnp = &ndp->ni_cnd; |
1098 | vfs_context_t ctx = cnp->cn_context; |
1099 | int vbusyflags = 0; |
1100 | int nc_generation = 0; |
1101 | vnode_t last_dp = NULLVP; |
1102 | int keep_going; |
1103 | int atroot; |
1104 | |
1105 | /* |
1106 | * Setup: break out flag bits into variables. |
1107 | */ |
1108 | if (cnp->cn_flags & NOCACHE) { |
1109 | docache = 0; |
1110 | } |
1111 | wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT); |
1112 | rdonly = cnp->cn_flags & RDONLY; |
1113 | cnp->cn_flags &= ~ISSYMLINK; |
1114 | cnp->cn_consume = 0; |
1115 | |
1116 | dp = ndp->ni_startdir; |
1117 | ndp->ni_startdir = NULLVP; |
1118 | |
1119 | if ((cnp->cn_flags & CN_NBMOUNTLOOK) != 0) { |
1120 | vbusyflags = LK_NOWAIT; |
1121 | } |
1122 | cp = cnp->cn_nameptr; |
1123 | |
1124 | if (*cp == '\0') { |
1125 | if ((vnode_getwithref(vp: dp))) { |
1126 | dp = NULLVP; |
1127 | error = ENOENT; |
1128 | goto bad; |
1129 | } |
1130 | ndp->ni_vp = dp; |
1131 | error = lookup_handle_emptyname(ndp, cnp, wantparent); |
1132 | if (error) { |
1133 | goto bad; |
1134 | } |
1135 | |
1136 | return 0; |
1137 | } |
1138 | dirloop: |
1139 | atroot = 0; |
1140 | ndp->ni_vp = NULLVP; |
1141 | |
1142 | if ((error = cache_lookup_path(ndp, cnp, dp, context: ctx, dp_authorized: &dp_authorized, last_dp))) { |
1143 | dp = NULLVP; |
1144 | goto bad; |
1145 | } |
1146 | if ((cnp->cn_flags & ISLASTCN)) { |
1147 | if (docache) { |
1148 | cnp->cn_flags |= MAKEENTRY; |
1149 | } |
1150 | } else { |
1151 | cnp->cn_flags |= MAKEENTRY; |
1152 | } |
1153 | |
1154 | dp = ndp->ni_dvp; |
1155 | |
1156 | if (ndp->ni_vp != NULLVP) { |
1157 | /* |
1158 | * cache_lookup_path returned a non-NULL ni_vp then, |
1159 | * we're guaranteed that the dp is a VDIR, it's |
1160 | * been authorized, and vp is not ".." |
1161 | * |
1162 | * make sure we don't try to enter the name back into |
1163 | * the cache if this vp is purged before we get to that |
1164 | * check since we won't have serialized behind whatever |
1165 | * activity is occurring in the FS that caused the purge |
1166 | */ |
1167 | if (dp != NULLVP) { |
1168 | nc_generation = dp->v_nc_generation - 1; |
1169 | } |
1170 | |
1171 | goto returned_from_lookup_path; |
1172 | } |
1173 | |
1174 | /* |
1175 | * Handle "..": two special cases. |
1176 | * 1. If at root directory (e.g. after chroot) |
1177 | * or at absolute root directory |
1178 | * then ignore it so can't get out. |
1179 | * 2. If this vnode is the root of a mounted |
1180 | * filesystem, then replace it with the |
1181 | * vnode which was mounted on so we take the |
1182 | * .. in the other file system. |
1183 | */ |
1184 | if ((cnp->cn_flags & ISDOTDOT)) { |
1185 | /* |
1186 | * if this is a chroot'ed process, check if the current |
1187 | * directory is still a subdirectory of the process's |
1188 | * root directory. |
1189 | */ |
1190 | if (ndp->ni_rootdir && (ndp->ni_rootdir != rootvnode) && |
1191 | dp != ndp->ni_rootdir) { |
1192 | int sdir_error; |
1193 | int is_subdir = FALSE; |
1194 | |
1195 | sdir_error = vnode_issubdir(vp: dp, dvp: ndp->ni_rootdir, |
1196 | is_subdir: &is_subdir, ctx: vfs_context_kernel()); |
1197 | |
1198 | /* |
1199 | * If we couldn't determine if dp is a subdirectory of |
1200 | * ndp->ni_rootdir (sdir_error != 0), we let the request |
1201 | * proceed. |
1202 | */ |
1203 | if (!sdir_error && !is_subdir) { |
1204 | vnode_put(vp: dp); |
1205 | dp = ndp->ni_rootdir; |
1206 | /* |
1207 | * There's a ref on the process's root directory |
1208 | * but we can't use vnode_getwithref here as |
1209 | * there is nothing preventing that ref being |
1210 | * released by another thread. |
1211 | */ |
1212 | if (vnode_get(dp)) { |
1213 | error = ENOENT; |
1214 | goto bad; |
1215 | } |
1216 | } |
1217 | } |
1218 | |
1219 | for (;;) { |
1220 | if (dp == ndp->ni_rootdir || dp == rootvnode) { |
1221 | ndp->ni_dvp = dp; |
1222 | ndp->ni_vp = dp; |
1223 | /* |
1224 | * we're pinned at the root |
1225 | * we've already got one reference on 'dp' |
1226 | * courtesy of cache_lookup_path... take |
1227 | * another one for the ".." |
1228 | * if we fail to get the new reference, we'll |
1229 | * drop our original down in 'bad' |
1230 | */ |
1231 | if ((vnode_get(dp))) { |
1232 | error = ENOENT; |
1233 | goto bad; |
1234 | } |
1235 | atroot = 1; |
1236 | goto returned_from_lookup_path; |
1237 | } |
1238 | if ((dp->v_flag & VROOT) == 0 || |
1239 | (cnp->cn_flags & NOCROSSMOUNT)) { |
1240 | break; |
1241 | } |
1242 | if (dp->v_mount == NULL) { /* forced umount */ |
1243 | error = EBADF; |
1244 | goto bad; |
1245 | } |
1246 | tdp = dp; |
1247 | dp = tdp->v_mount->mnt_vnodecovered; |
1248 | |
1249 | if ((vnode_getwithref(vp: dp))) { |
1250 | vnode_put(vp: tdp); |
1251 | dp = NULLVP; |
1252 | error = ENOENT; |
1253 | goto bad; |
1254 | } |
1255 | |
1256 | vnode_put(vp: tdp); |
1257 | |
1258 | ndp->ni_dvp = dp; |
1259 | dp_authorized = 0; |
1260 | } |
1261 | } |
1262 | |
1263 | /* |
1264 | * We now have a segment name to search for, and a directory to search. |
1265 | */ |
1266 | #if CONFIG_UNION_MOUNTS |
1267 | unionlookup: |
1268 | #endif /* CONFIG_UNION_MOUNTS */ |
1269 | ndp->ni_vp = NULLVP; |
1270 | |
1271 | if (dp->v_type != VDIR) { |
1272 | error = ENOTDIR; |
1273 | goto lookup_error; |
1274 | } |
1275 | if ((cnp->cn_flags & DONOTAUTH) != DONOTAUTH) { |
1276 | error = lookup_authorize_search(dp, cnp, dp_authorized_in_cache: dp_authorized, ctx); |
1277 | if (error) { |
1278 | goto lookup_error; |
1279 | } |
1280 | } |
1281 | |
1282 | /* |
1283 | * Now that we've authorized a lookup, can bail out if the filesystem |
1284 | * will be doing a batched operation. Return an iocount on dvp. |
1285 | */ |
1286 | #if NAMEDRSRCFORK |
1287 | if ((cnp->cn_flags & ISLASTCN) && namei_compound_available(dp, ndp) && !(cnp->cn_flags & CN_WANTSRSRCFORK)) { |
1288 | #else |
1289 | if ((cnp->cn_flags & ISLASTCN) && namei_compound_available(dp, ndp)) { |
1290 | #endif /* NAMEDRSRCFORK */ |
1291 | ndp->ni_flag |= NAMEI_UNFINISHED; |
1292 | ndp->ni_ncgeneration = dp->v_nc_generation; |
1293 | return 0; |
1294 | } |
1295 | |
1296 | nc_generation = dp->v_nc_generation; |
1297 | |
1298 | /* |
1299 | * Note: |
1300 | * Filesystems that support hardlinks may want to call vnode_update_identity |
1301 | * if the lookup operation below will modify the in-core vnode to belong to a new point |
1302 | * in the namespace. VFS cannot infer whether or not the look up operation makes the vnode |
1303 | * name change or change parents. Without this, the lookup may make update |
1304 | * filesystem-specific in-core metadata but fail to update the v_parent or v_name |
1305 | * fields in the vnode. If VFS were to do this, it would be necessary to call |
1306 | * vnode_update_identity on every lookup operation -- expensive! |
1307 | * |
1308 | * However, even with this in place, multiple lookups may occur in between this lookup |
1309 | * and the subsequent vnop, so, at best, we could only guarantee that you would get a |
1310 | * valid path back, and not necessarily the one that you wanted. |
1311 | * |
1312 | * Example: |
1313 | * /tmp/a == /foo/b |
1314 | * |
1315 | * If you are now looking up /foo/b and the vnode for this link represents /tmp/a, |
1316 | * vnode_update_identity will fix the parentage so that you can get /foo/b back |
1317 | * through the v_parent chain (preventing you from getting /tmp/b back). It would |
1318 | * not fix whether or not you should or should not get /tmp/a vs. /foo/b. |
1319 | */ |
1320 | |
1321 | error = VNOP_LOOKUP(dp, &ndp->ni_vp, cnp, ctx); |
1322 | |
1323 | if (error) { |
1324 | lookup_error: |
1325 | #if CONFIG_UNION_MOUNTS |
1326 | if ((error == ENOENT) && |
1327 | (dp->v_mount != NULL) && |
1328 | (dp->v_mount->mnt_flag & MNT_UNION)) { |
1329 | tdp = dp; |
1330 | error = lookup_traverse_union(dvp: tdp, new_dvp: &dp, ctx); |
1331 | vnode_put(vp: tdp); |
1332 | if (error) { |
1333 | dp = NULLVP; |
1334 | goto bad; |
1335 | } |
1336 | |
1337 | ndp->ni_dvp = dp; |
1338 | dp_authorized = 0; |
1339 | goto unionlookup; |
1340 | } |
1341 | #endif /* CONFIG_UNION_MOUNTS */ |
1342 | |
1343 | if (error != EJUSTRETURN) { |
1344 | goto bad; |
1345 | } |
1346 | |
1347 | if (ndp->ni_vp != NULLVP) { |
1348 | panic("leaf should be empty" ); |
1349 | } |
1350 | |
1351 | #if NAMEDRSRCFORK |
1352 | /* |
1353 | * At this point, error should be EJUSTRETURN. |
1354 | * |
1355 | * If CN_WANTSRSRCFORK is set, that implies that the |
1356 | * underlying filesystem could not find the "parent" of the |
1357 | * resource fork (the data fork), and we are doing a lookup |
1358 | * for a CREATE event. |
1359 | * |
1360 | * However, this should be converted to an error, as the |
1361 | * failure to find this parent should disallow further |
1362 | * progress to try and acquire a resource fork vnode. |
1363 | */ |
1364 | if (cnp->cn_flags & CN_WANTSRSRCFORK) { |
1365 | error = ENOENT; |
1366 | goto bad; |
1367 | } |
1368 | #endif |
1369 | |
1370 | error = lookup_validate_creation_path(ndp); |
1371 | if (error) { |
1372 | goto bad; |
1373 | } |
1374 | /* |
1375 | * We return with ni_vp NULL to indicate that the entry |
1376 | * doesn't currently exist, leaving a pointer to the |
1377 | * referenced directory vnode in ndp->ni_dvp. |
1378 | */ |
1379 | if (cnp->cn_flags & SAVESTART) { |
1380 | if ((vnode_get(ndp->ni_dvp))) { |
1381 | error = ENOENT; |
1382 | goto bad; |
1383 | } |
1384 | ndp->ni_startdir = ndp->ni_dvp; |
1385 | } |
1386 | if (!wantparent) { |
1387 | vnode_put(vp: ndp->ni_dvp); |
1388 | } |
1389 | |
1390 | if (kdebug_enable) { |
1391 | kdebug_lookup(dp: ndp->ni_dvp, cnp); |
1392 | } |
1393 | return 0; |
1394 | } |
1395 | returned_from_lookup_path: |
1396 | /* We'll always have an iocount on ni_vp when this finishes. */ |
1397 | error = lookup_handle_found_vnode(ndp, cnp, rdonly, vbusyflags, keep_going: &keep_going, nc_generation, wantparent, atroot, ctx); |
1398 | if (error != 0) { |
1399 | goto bad2; |
1400 | } |
1401 | |
1402 | if (keep_going) { |
1403 | dp = ndp->ni_vp; |
1404 | |
1405 | /* namei() will handle symlinks */ |
1406 | if ((dp->v_type == VLNK) && |
1407 | ((cnp->cn_flags & FOLLOW) || (ndp->ni_flag & NAMEI_TRAILINGSLASH) || *ndp->ni_next == '/')) { |
1408 | return 0; |
1409 | } |
1410 | |
1411 | /* |
1412 | * Otherwise, there's more path to process. |
1413 | * cache_lookup_path is now responsible for dropping io ref on dp |
1414 | * when it is called again in the dirloop. This ensures we hold |
1415 | * a ref on dp until we complete the next round of lookup. |
1416 | */ |
1417 | last_dp = dp; |
1418 | |
1419 | goto dirloop; |
1420 | } |
1421 | |
1422 | return 0; |
1423 | bad2: |
1424 | if (ndp->ni_dvp) { |
1425 | vnode_put(vp: ndp->ni_dvp); |
1426 | } |
1427 | |
1428 | vnode_put(vp: ndp->ni_vp); |
1429 | ndp->ni_vp = NULLVP; |
1430 | |
1431 | if (kdebug_enable) { |
1432 | kdebug_lookup(dp, cnp); |
1433 | } |
1434 | return error; |
1435 | |
1436 | bad: |
1437 | if (dp) { |
1438 | vnode_put(vp: dp); |
1439 | } |
1440 | ndp->ni_vp = NULLVP; |
1441 | |
1442 | if (kdebug_enable) { |
1443 | kdebug_lookup(dp, cnp); |
1444 | } |
1445 | return error; |
1446 | } |
1447 | |
1448 | #if CONFIG_UNION_MOUNTS |
1449 | /* |
1450 | * Given a vnode in a union mount, traverse to the equivalent |
1451 | * vnode in the underlying mount. |
1452 | */ |
1453 | int |
1454 | lookup_traverse_union(vnode_t dvp, vnode_t *new_dvp, vfs_context_t ctx) |
1455 | { |
1456 | char *path = NULL, *pp; |
1457 | const char *name, *np; |
1458 | size_t len; |
1459 | int error = 0; |
1460 | struct nameidata nd; |
1461 | vnode_t vp = dvp; |
1462 | |
1463 | *new_dvp = NULL; |
1464 | |
1465 | if (vp && vp->v_flag & VROOT) { |
1466 | *new_dvp = vp->v_mount->mnt_vnodecovered; |
1467 | if (vnode_getwithref(vp: *new_dvp)) { |
1468 | return ENOENT; |
1469 | } |
1470 | return 0; |
1471 | } |
1472 | |
1473 | path = zalloc_flags(ZV_NAMEI, Z_WAITOK | Z_NOFAIL); |
1474 | |
1475 | /* |
1476 | * Walk back up to the mountpoint following the |
1477 | * v_parent chain and build a slash-separated path. |
1478 | * Then lookup that path starting with the covered vnode. |
1479 | */ |
1480 | pp = path + (MAXPATHLEN - 1); |
1481 | *pp = '\0'; |
1482 | |
1483 | while (1) { |
1484 | name = vnode_getname(vp); |
1485 | if (name == NULL) { |
1486 | printf("lookup_traverse_union: null parent name: .%s\n" , pp); |
1487 | error = ENOENT; |
1488 | goto done; |
1489 | } |
1490 | len = strlen(s: name); |
1491 | if ((len + 1) > (size_t)(pp - path)) { // Enough space for this name ? |
1492 | error = ENAMETOOLONG; |
1493 | vnode_putname(name); |
1494 | goto done; |
1495 | } |
1496 | for (np = name + len; len > 0; len--) { // Copy name backwards |
1497 | *--pp = *--np; |
1498 | } |
1499 | vnode_putname(name); |
1500 | vp = vp->v_parent; |
1501 | if (vp == NULLVP || vp->v_flag & VROOT) { |
1502 | break; |
1503 | } |
1504 | *--pp = '/'; |
1505 | } |
1506 | |
1507 | /* Evaluate the path in the underlying mount */ |
1508 | NDINIT(&nd, LOOKUP, OP_LOOKUP, USEDVP, UIO_SYSSPACE, CAST_USER_ADDR_T(pp), ctx); |
1509 | nd.ni_dvp = dvp->v_mount->mnt_vnodecovered; |
1510 | error = namei(ndp: &nd); |
1511 | if (error == 0) { |
1512 | *new_dvp = nd.ni_vp; |
1513 | } |
1514 | nameidone(&nd); |
1515 | done: |
1516 | if (path) { |
1517 | zfree(ZV_NAMEI, path); |
1518 | } |
1519 | return error; |
1520 | } |
1521 | #endif /* CONFIG_UNION_MOUNTS */ |
1522 | |
1523 | int |
1524 | lookup_validate_creation_path(struct nameidata *ndp) |
1525 | { |
1526 | struct componentname *cnp = &ndp->ni_cnd; |
1527 | |
1528 | /* |
1529 | * If creating and at end of pathname, then can consider |
1530 | * allowing file to be created. |
1531 | */ |
1532 | if (cnp->cn_flags & RDONLY) { |
1533 | return EROFS; |
1534 | } |
1535 | if ((cnp->cn_flags & ISLASTCN) && (ndp->ni_flag & NAMEI_TRAILINGSLASH) && !(cnp->cn_flags & WILLBEDIR)) { |
1536 | return ENOENT; |
1537 | } |
1538 | |
1539 | return 0; |
1540 | } |
1541 | |
1542 | /* |
1543 | * Modifies only ni_vp. Always returns with ni_vp still valid (iocount held). |
1544 | */ |
1545 | static int |
1546 | lookup_traverse_mountpoints(struct nameidata *ndp, struct componentname *cnp, vnode_t dp, |
1547 | int vbusyflags, vfs_context_t ctx) |
1548 | { |
1549 | mount_t mp; |
1550 | vnode_t tdp; |
1551 | int error = 0; |
1552 | uint32_t depth = 0; |
1553 | vnode_t mounted_on_dp; |
1554 | int current_mount_generation = 0; |
1555 | #if CONFIG_TRIGGERS |
1556 | vnode_t triggered_dp = NULLVP; |
1557 | int retry_cnt = 0; |
1558 | #define MAX_TRIGGER_RETRIES 1 |
1559 | #endif |
1560 | |
1561 | if (dp->v_type != VDIR || cnp->cn_flags & NOCROSSMOUNT) { |
1562 | return 0; |
1563 | } |
1564 | |
1565 | mounted_on_dp = dp; |
1566 | #if CONFIG_TRIGGERS |
1567 | restart: |
1568 | #endif |
1569 | current_mount_generation = mount_generation; |
1570 | |
1571 | while (dp->v_mountedhere) { |
1572 | vnode_lock_spin(dp); |
1573 | if ((mp = dp->v_mountedhere)) { |
1574 | mp->mnt_crossref++; |
1575 | vnode_unlock(dp); |
1576 | } else { |
1577 | vnode_unlock(dp); |
1578 | break; |
1579 | } |
1580 | |
1581 | if (ISSET(mp->mnt_lflag, MNT_LFORCE)) { |
1582 | mount_dropcrossref(mp, dp, 0); |
1583 | break; // don't traverse into a forced unmount |
1584 | } |
1585 | |
1586 | |
1587 | if (vfs_busy(mp, flags: vbusyflags)) { |
1588 | mount_dropcrossref(mp, dp, 0); |
1589 | if (vbusyflags == LK_NOWAIT) { |
1590 | error = ENOENT; |
1591 | goto out; |
1592 | } |
1593 | |
1594 | continue; |
1595 | } |
1596 | |
1597 | error = VFS_ROOT(mp, &tdp, ctx); |
1598 | |
1599 | mount_dropcrossref(mp, dp, 0); |
1600 | vfs_unbusy(mp); |
1601 | |
1602 | if (error) { |
1603 | goto out; |
1604 | } |
1605 | |
1606 | vnode_put(vp: dp); |
1607 | ndp->ni_vp = dp = tdp; |
1608 | if (dp->v_type != VDIR) { |
1609 | #if DEVELOPMENT || DEBUG |
1610 | panic("%s : Root of filesystem not a directory" , |
1611 | __FUNCTION__); |
1612 | #else |
1613 | break; |
1614 | #endif |
1615 | } |
1616 | depth++; |
1617 | } |
1618 | |
1619 | #if CONFIG_TRIGGERS |
1620 | /* |
1621 | * The triggered_dp check here is required but is susceptible to a |
1622 | * (unlikely) race in which trigger mount is done from here and is |
1623 | * unmounted before we get past vfs_busy above. We retry to deal with |
1624 | * that case but it has the side effect of unwanted retries for |
1625 | * "special" processes which don't want to trigger mounts. |
1626 | */ |
1627 | if (dp->v_resolve && retry_cnt < MAX_TRIGGER_RETRIES) { |
1628 | error = vnode_trigger_resolve(dp, ndp, ctx); |
1629 | if (error) { |
1630 | goto out; |
1631 | } |
1632 | if (dp == triggered_dp) { |
1633 | retry_cnt += 1; |
1634 | } else { |
1635 | retry_cnt = 0; |
1636 | } |
1637 | triggered_dp = dp; |
1638 | goto restart; |
1639 | } |
1640 | #endif /* CONFIG_TRIGGERS */ |
1641 | |
1642 | if (depth) { |
1643 | mp = mounted_on_dp->v_mountedhere; |
1644 | |
1645 | if (mp) { |
1646 | mount_lock_spin(mp); |
1647 | mp->mnt_realrootvp_vid = dp->v_id; |
1648 | mp->mnt_realrootvp = dp; |
1649 | mp->mnt_generation = current_mount_generation; |
1650 | mount_unlock(mp); |
1651 | } |
1652 | } |
1653 | |
1654 | return 0; |
1655 | |
1656 | out: |
1657 | return error; |
1658 | } |
1659 | |
1660 | /* |
1661 | * Takes ni_vp and ni_dvp non-NULL. Returns with *new_dp set to the location |
1662 | * at which to start a lookup with a resolved path, and all other iocounts dropped. |
1663 | */ |
1664 | static int |
1665 | lookup_handle_symlink(struct nameidata *ndp, vnode_t *new_dp, bool *new_dp_has_iocount, vfs_context_t ctx) |
1666 | { |
1667 | int error; |
1668 | char *cp; /* pointer into pathname argument */ |
1669 | uio_t auio; |
1670 | UIO_STACKBUF(uio_buf, 1); |
1671 | int need_newpathbuf; |
1672 | u_int linklen = 0; |
1673 | struct componentname *cnp = &ndp->ni_cnd; |
1674 | vnode_t dp; |
1675 | char *tmppn; |
1676 | u_int rsrclen = (cnp->cn_flags & CN_WANTSRSRCFORK) ? sizeof(_PATH_RSRCFORKSPEC) : 0; |
1677 | bool dp_has_iocount = false; |
1678 | |
1679 | if (ndp->ni_loopcnt++ >= MAXSYMLINKS) { |
1680 | return ELOOP; |
1681 | } |
1682 | #if CONFIG_MACF |
1683 | if ((error = mac_vnode_check_readlink(ctx, vp: ndp->ni_vp)) != 0) { |
1684 | return error; |
1685 | } |
1686 | #endif /* MAC */ |
1687 | if (ndp->ni_pathlen > 1 || !(cnp->cn_flags & HASBUF)) { |
1688 | need_newpathbuf = 1; |
1689 | } else { |
1690 | need_newpathbuf = 0; |
1691 | } |
1692 | |
1693 | if (need_newpathbuf) { |
1694 | cp = zalloc(view: ZV_NAMEI); |
1695 | } else { |
1696 | cp = cnp->cn_pnbuf; |
1697 | } |
1698 | auio = uio_createwithbuffer(a_iovcount: 1, a_offset: 0, a_spacetype: UIO_SYSSPACE, a_iodirection: UIO_READ, a_buf_p: &uio_buf[0], a_buffer_size: sizeof(uio_buf)); |
1699 | |
1700 | uio_addiov(a_uio: auio, CAST_USER_ADDR_T(cp), MAXPATHLEN); |
1701 | |
1702 | error = VNOP_READLINK(ndp->ni_vp, auio, ctx); |
1703 | |
1704 | if (!error) { |
1705 | user_ssize_t resid = uio_resid(a_uio: auio); |
1706 | |
1707 | assert(resid <= MAXPATHLEN); |
1708 | |
1709 | if (resid == MAXPATHLEN) { |
1710 | linklen = 0; |
1711 | } else { |
1712 | /* |
1713 | * Safe to set unsigned with a [larger] signed type here |
1714 | * because 0 <= uio_resid <= MAXPATHLEN and MAXPATHLEN |
1715 | * is only 1024. |
1716 | */ |
1717 | linklen = (u_int)strnlen(s: cp, MAXPATHLEN - (u_int)resid); |
1718 | } |
1719 | |
1720 | if (linklen == 0) { |
1721 | error = ENOENT; |
1722 | } else if (linklen + ndp->ni_pathlen + rsrclen > MAXPATHLEN) { |
1723 | error = ENAMETOOLONG; |
1724 | } |
1725 | } |
1726 | |
1727 | if (error) { |
1728 | if (need_newpathbuf) { |
1729 | zfree(ZV_NAMEI, cp); |
1730 | } |
1731 | return error; |
1732 | } |
1733 | |
1734 | if (need_newpathbuf) { |
1735 | tmppn = cnp->cn_pnbuf; |
1736 | bcopy(src: ndp->ni_next, dst: cp + linklen, n: ndp->ni_pathlen); |
1737 | cnp->cn_pnbuf = cp; |
1738 | cnp->cn_pnlen = MAXPATHLEN; |
1739 | |
1740 | if ((cnp->cn_flags & HASBUF)) { |
1741 | zfree(ZV_NAMEI, tmppn); |
1742 | } else { |
1743 | cnp->cn_flags |= HASBUF; |
1744 | } |
1745 | } else { |
1746 | cnp->cn_pnbuf[linklen] = '\0'; |
1747 | } |
1748 | |
1749 | ndp->ni_pathlen += linklen; |
1750 | cnp->cn_nameptr = cnp->cn_pnbuf; |
1751 | |
1752 | /* |
1753 | * starting point for 'relative' |
1754 | * symbolic link path |
1755 | */ |
1756 | dp = ndp->ni_dvp; |
1757 | |
1758 | /* |
1759 | * get rid of reference returned via 'lookup' |
1760 | * ni_dvp is released only if we restart at /. |
1761 | */ |
1762 | vnode_put(vp: ndp->ni_vp); |
1763 | ndp->ni_vp = NULLVP; |
1764 | ndp->ni_dvp = NULLVP; |
1765 | |
1766 | dp_has_iocount = true; |
1767 | |
1768 | /* |
1769 | * Check if symbolic link restarts us at the root |
1770 | */ |
1771 | if (*(cnp->cn_nameptr) == '/') { |
1772 | while (*(cnp->cn_nameptr) == '/') { |
1773 | cnp->cn_nameptr++; |
1774 | ndp->ni_pathlen--; |
1775 | } |
1776 | if (linklen != 0) { |
1777 | vnode_put(vp: dp); /* ALWAYS have a dvp for a symlink */ |
1778 | dp_has_iocount = false; |
1779 | if ((dp = ndp->ni_rootdir) == NULLVP) { |
1780 | return ENOENT; |
1781 | } |
1782 | } |
1783 | } |
1784 | |
1785 | *new_dp = dp; |
1786 | *new_dp_has_iocount = dp_has_iocount; |
1787 | |
1788 | return 0; |
1789 | } |
1790 | |
1791 | /* |
1792 | * relookup - lookup a path name component |
1793 | * Used by lookup to re-aquire things. |
1794 | */ |
1795 | int |
1796 | relookup(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp) |
1797 | { |
1798 | struct vnode *dp = NULL; /* the directory we are searching */ |
1799 | int wantparent; /* 1 => wantparent or lockparent flag */ |
1800 | int rdonly; /* lookup read-only flag bit */ |
1801 | int error = 0; |
1802 | #ifdef NAMEI_DIAGNOSTIC |
1803 | int i, newhash; /* DEBUG: check name hash */ |
1804 | char *cp; /* DEBUG: check name ptr/len */ |
1805 | #endif |
1806 | vfs_context_t ctx = cnp->cn_context; |
1807 | |
1808 | /* |
1809 | * Setup: break out flag bits into variables. |
1810 | */ |
1811 | wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT); |
1812 | rdonly = cnp->cn_flags & RDONLY; |
1813 | cnp->cn_flags &= ~ISSYMLINK; |
1814 | |
1815 | if (cnp->cn_flags & NOCACHE) { |
1816 | cnp->cn_flags &= ~MAKEENTRY; |
1817 | } else { |
1818 | cnp->cn_flags |= MAKEENTRY; |
1819 | } |
1820 | |
1821 | dp = dvp; |
1822 | |
1823 | /* |
1824 | * Check for degenerate name (e.g. / or "") |
1825 | * which is a way of talking about a directory, |
1826 | * e.g. like "/." or ".". |
1827 | */ |
1828 | if (cnp->cn_nameptr[0] == '\0') { |
1829 | if (cnp->cn_nameiop != LOOKUP || wantparent) { |
1830 | error = EISDIR; |
1831 | goto bad; |
1832 | } |
1833 | if (dp->v_type != VDIR) { |
1834 | error = ENOTDIR; |
1835 | goto bad; |
1836 | } |
1837 | if ((vnode_get(dp))) { |
1838 | error = ENOENT; |
1839 | goto bad; |
1840 | } |
1841 | *vpp = dp; |
1842 | |
1843 | if (cnp->cn_flags & SAVESTART) { |
1844 | panic("lookup: SAVESTART" ); |
1845 | } |
1846 | return 0; |
1847 | } |
1848 | /* |
1849 | * We now have a segment name to search for, and a directory to search. |
1850 | */ |
1851 | if ((error = VNOP_LOOKUP(dp, vpp, cnp, ctx))) { |
1852 | if (error != EJUSTRETURN) { |
1853 | goto bad; |
1854 | } |
1855 | #if DIAGNOSTIC |
1856 | if (*vpp != NULL) { |
1857 | panic("leaf should be empty" ); |
1858 | } |
1859 | #endif |
1860 | /* |
1861 | * If creating and at end of pathname, then can consider |
1862 | * allowing file to be created. |
1863 | */ |
1864 | if (rdonly) { |
1865 | error = EROFS; |
1866 | goto bad; |
1867 | } |
1868 | /* |
1869 | * We return with ni_vp NULL to indicate that the entry |
1870 | * doesn't currently exist, leaving a pointer to the |
1871 | * (possibly locked) directory inode in ndp->ni_dvp. |
1872 | */ |
1873 | return 0; |
1874 | } |
1875 | dp = *vpp; |
1876 | |
1877 | #if DIAGNOSTIC |
1878 | /* |
1879 | * Check for symbolic link |
1880 | */ |
1881 | if (dp->v_type == VLNK && (cnp->cn_flags & FOLLOW)) { |
1882 | panic("relookup: symlink found." ); |
1883 | } |
1884 | #endif |
1885 | |
1886 | /* |
1887 | * Disallow directory write attempts on read-only file systems. |
1888 | */ |
1889 | if (rdonly && |
1890 | (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { |
1891 | error = EROFS; |
1892 | goto bad2; |
1893 | } |
1894 | /* ASSERT(dvp == ndp->ni_startdir) */ |
1895 | |
1896 | return 0; |
1897 | |
1898 | bad2: |
1899 | vnode_put(vp: dp); |
1900 | bad: |
1901 | *vpp = NULL; |
1902 | |
1903 | return error; |
1904 | } |
1905 | |
1906 | /* |
1907 | * Free pathname buffer |
1908 | */ |
1909 | void |
1910 | nameidone(struct nameidata *ndp) |
1911 | { |
1912 | if (ndp->ni_cnd.cn_flags & HASBUF) { |
1913 | char *tmp = ndp->ni_cnd.cn_pnbuf; |
1914 | |
1915 | ndp->ni_cnd.cn_pnbuf = NULL; |
1916 | ndp->ni_cnd.cn_flags &= ~HASBUF; |
1917 | zfree(ZV_NAMEI, tmp); |
1918 | } |
1919 | } |
1920 | |
1921 | |
1922 | /* |
1923 | * Log (part of) a pathname using kdebug, as used by fs_usage. The path up to |
1924 | * and including the current component name are logged. Up to NUMPARMS * 4 |
1925 | * bytes of pathname will be logged. If the path to be logged is longer than |
1926 | * that, then the last NUMPARMS * 4 bytes are logged. That is, the truncation |
1927 | * removes the leading portion of the path. |
1928 | * |
1929 | * The logging is done via multiple KDBG_RELEASE calls. The first one is marked |
1930 | * with DBG_FUNC_START. The last one is marked with DBG_FUNC_END (in addition |
1931 | * to DBG_FUNC_START if it is also the first). There may be intermediate ones |
1932 | * with neither DBG_FUNC_START nor DBG_FUNC_END. |
1933 | * |
1934 | * The first event passes the vnode pointer and 24 or 32 (on K32, 12 or 24) |
1935 | * bytes of pathname. The remaining events add 32 (on K32, 16) bytes of |
1936 | * pathname each. The minimum number of events required to pass the path are |
1937 | * used. Any excess padding in the final event (because not all of the 24 or 32 |
1938 | * (on K32, 12 or 16) bytes are needed for the remainder of the path) is set to |
1939 | * zero bytes, or '>' if there is more path beyond the current component name |
1940 | * (usually because an intermediate component was not found). |
1941 | * |
1942 | * NOTE: If the path length is greater than NUMPARMS * 4, or is not of the form |
1943 | * 24 + N * 32 (or on K32, 12 + N * 16), there will be no padding. |
1944 | */ |
1945 | #if (KDEBUG_LEVEL >= KDEBUG_LEVEL_IST) |
1946 | |
1947 | void |
1948 | kdebug_vfs_lookup(unsigned long *path_words, int path_len, void *vnp, |
1949 | uint32_t flags) |
1950 | { |
1951 | bool noprocfilt = flags & KDBG_VFS_LOOKUP_FLAG_NOPROCFILT; |
1952 | |
1953 | assert(path_len >= 0); |
1954 | |
1955 | int code = ((flags & KDBG_VFS_LOOKUP_FLAG_LOOKUP) ? VFS_LOOKUP : |
1956 | VFS_LOOKUP_DONE) | DBG_FUNC_START; |
1957 | |
1958 | if (path_len <= (3 * (int)sizeof(long))) { |
1959 | code |= DBG_FUNC_END; |
1960 | } |
1961 | |
1962 | if (noprocfilt) { |
1963 | KDBG_RELEASE_NOPROCFILT(code, kdebug_vnode(vnp), path_words[0], |
1964 | path_words[1], path_words[2]); |
1965 | } else { |
1966 | KDBG_RELEASE(code, kdebug_vnode(vnp), path_words[0], path_words[1], |
1967 | path_words[2]); |
1968 | } |
1969 | |
1970 | code &= ~DBG_FUNC_START; |
1971 | |
1972 | for (int i = 3; i * (int)sizeof(long) < path_len; i += 4) { |
1973 | if ((i + 4) * (int)sizeof(long) >= path_len) { |
1974 | code |= DBG_FUNC_END; |
1975 | } |
1976 | |
1977 | if (noprocfilt) { |
1978 | KDBG_RELEASE_NOPROCFILT(code, path_words[i], path_words[i + 1], |
1979 | path_words[i + 2], path_words[i + 3]); |
1980 | } else { |
1981 | KDBG_RELEASE(code, path_words[i], path_words[i + 1], |
1982 | path_words[i + 2], path_words[i + 3]); |
1983 | } |
1984 | } |
1985 | } |
1986 | |
1987 | void |
1988 | kdebug_lookup_gen_events(long *path_words, int path_len, void *vnp, bool lookup) |
1989 | { |
1990 | assert(path_len >= 0); |
1991 | kdebug_vfs_lookup(path_words: (unsigned long *)path_words, path_len, vnp, |
1992 | flags: lookup ? KDBG_VFS_LOOKUP_FLAG_LOOKUP : 0); |
1993 | } |
1994 | |
1995 | void |
1996 | kdebug_lookup(vnode_t vnp, struct componentname *cnp) |
1997 | { |
1998 | unsigned long path_words[NUMPARMS]; |
1999 | |
2000 | /* |
2001 | * Truncate the leading portion of the path to fit in path_words. |
2002 | */ |
2003 | char *path_end = cnp->cn_nameptr + cnp->cn_namelen; |
2004 | size_t path_len = MIN(path_end - cnp->cn_pnbuf, |
2005 | (ssize_t)sizeof(path_words)); |
2006 | assert(path_len >= 0); |
2007 | char *path_trunc = path_end - path_len; |
2008 | |
2009 | memcpy(dst: path_words, src: path_trunc, n: path_len); |
2010 | |
2011 | /* |
2012 | * Pad with '\0' or '>'. |
2013 | */ |
2014 | if (path_len < (ssize_t)sizeof(path_words)) { |
2015 | bool complete_str = *(cnp->cn_nameptr + cnp->cn_namelen) == '\0'; |
2016 | memset(s: (char *)path_words + path_len, c: complete_str ? '\0' : '>', |
2017 | n: sizeof(path_words) - path_len); |
2018 | } |
2019 | kdebug_vfs_lookup(path_words, path_len: (int)path_len, vnp, KDBG_VFS_LOOKUP_FLAG_LOOKUP); |
2020 | } |
2021 | |
2022 | #else /* (KDEBUG_LEVEL >= KDEBUG_LEVEL_IST) */ |
2023 | |
2024 | void |
2025 | kdebug_vfs_lookup(long *dbg_parms __unused, int dbg_namelen __unused, |
2026 | void *dp __unused, __unused uint32_t flags) |
2027 | { |
2028 | } |
2029 | |
2030 | static void |
2031 | kdebug_lookup(struct vnode *dp __unused, struct componentname *cnp __unused) |
2032 | { |
2033 | } |
2034 | #endif /* (KDEBUG_LEVEL >= KDEBUG_LEVEL_IST) */ |
2035 | |
2036 | int |
2037 | vfs_getbyid(fsid_t *fsid, ino64_t ino, vnode_t *vpp, vfs_context_t ctx) |
2038 | { |
2039 | mount_t mp; |
2040 | int error; |
2041 | |
2042 | mp = mount_lookupby_volfsid(fsid->val[0], 1); |
2043 | if (mp == NULL) { |
2044 | return EINVAL; |
2045 | } |
2046 | |
2047 | /* Get the target vnode. */ |
2048 | if (ino == 2) { |
2049 | error = VFS_ROOT(mp, vpp, ctx); |
2050 | } else { |
2051 | error = VFS_VGET(mp, ino, vpp, ctx); |
2052 | } |
2053 | |
2054 | vfs_unbusy(mp); |
2055 | return error; |
2056 | } |
2057 | /* |
2058 | * Obtain the real path from a legacy volfs style path. |
2059 | * |
2060 | * Valid formats of input path: |
2061 | * |
2062 | * "555/@" |
2063 | * "555/2" |
2064 | * "555/123456" |
2065 | * "555/123456/foobar" |
2066 | * |
2067 | * Where: |
2068 | * 555 represents the volfs file system id |
2069 | * '@' and '2' are aliases to the root of a file system |
2070 | * 123456 represents a file id |
2071 | * "foobar" represents a file name |
2072 | */ |
2073 | #if CONFIG_VOLFS |
2074 | static int |
2075 | vfs_getrealpath(const char * path, char * realpath, size_t bufsize, vfs_context_t ctx) |
2076 | { |
2077 | vnode_t vp; |
2078 | struct mount *mp = NULL; |
2079 | char *str; |
2080 | char ch; |
2081 | unsigned long id; |
2082 | ino64_t ino; |
2083 | int error; |
2084 | int length; |
2085 | |
2086 | /* Get file system id and move str to next component. */ |
2087 | id = strtoul(path, &str, 10); |
2088 | if (id == 0 || str[0] != '/') { |
2089 | return EINVAL; |
2090 | } |
2091 | while (*str == '/') { |
2092 | str++; |
2093 | } |
2094 | ch = *str; |
2095 | |
2096 | if (id > INT_MAX) { |
2097 | return ENOENT; |
2098 | } |
2099 | mp = mount_lookupby_volfsid((int)id, 1); |
2100 | if (mp == NULL) { |
2101 | return EINVAL; /* unexpected failure */ |
2102 | } |
2103 | /* Check for an alias to a file system root. */ |
2104 | if (ch == '@' && str[1] == '\0') { |
2105 | ino = 2; |
2106 | str++; |
2107 | } else { |
2108 | /* Get file id and move str to next component. */ |
2109 | ino = strtouq(str, &str, 10); |
2110 | } |
2111 | |
2112 | /* Get the target vnode. */ |
2113 | if (ino == 2) { |
2114 | struct vfs_attr vfsattr; |
2115 | int use_vfs_root = TRUE; |
2116 | |
2117 | VFSATTR_INIT(&vfsattr); |
2118 | VFSATTR_WANTED(&vfsattr, f_capabilities); |
2119 | if (vfs_getattr(mp, vfa: &vfsattr, ctx: vfs_context_kernel()) == 0 && |
2120 | VFSATTR_IS_SUPPORTED(&vfsattr, f_capabilities)) { |
2121 | if ((vfsattr.f_capabilities.capabilities[VOL_CAPABILITIES_FORMAT] & VOL_CAP_FMT_VOL_GROUPS) && |
2122 | (vfsattr.f_capabilities.valid[VOL_CAPABILITIES_FORMAT] & VOL_CAP_FMT_VOL_GROUPS)) { |
2123 | use_vfs_root = FALSE; |
2124 | } |
2125 | } |
2126 | |
2127 | if (use_vfs_root) { |
2128 | error = VFS_ROOT(mp, &vp, ctx); |
2129 | } else { |
2130 | error = VFS_VGET(mp, ino, &vp, ctx); |
2131 | } |
2132 | } else { |
2133 | error = VFS_VGET(mp, ino, &vp, ctx); |
2134 | } |
2135 | vfs_unbusy(mp); |
2136 | if (error) { |
2137 | goto out; |
2138 | } |
2139 | realpath[0] = '\0'; |
2140 | |
2141 | /* Get the absolute path to this vnode. */ |
2142 | error = build_path(first_vp: vp, buff: realpath, buflen: (int)bufsize, outlen: &length, flags: 0, ctx); |
2143 | vnode_put(vp); |
2144 | |
2145 | if (error == 0 && *str != '\0') { |
2146 | size_t attempt = strlcat(dst: realpath, src: str, MAXPATHLEN); |
2147 | if (attempt > MAXPATHLEN) { |
2148 | error = ENAMETOOLONG; |
2149 | } |
2150 | } |
2151 | out: |
2152 | return error; |
2153 | } |
2154 | #endif |
2155 | |
2156 | void |
2157 | lookup_compound_vnop_post_hook(int error, vnode_t dvp, vnode_t vp, struct nameidata *ndp, int did_create) |
2158 | { |
2159 | if (error == 0 && vp == NULLVP) { |
2160 | panic("NULL vp with error == 0." ); |
2161 | } |
2162 | |
2163 | /* |
2164 | * We don't want to do any of this if we didn't use the compound vnop |
2165 | * to perform the lookup... i.e. if we're allowing and using the legacy pattern, |
2166 | * where we did a full lookup. |
2167 | */ |
2168 | if ((ndp->ni_flag & NAMEI_COMPOUND_OP_MASK) == 0) { |
2169 | return; |
2170 | } |
2171 | |
2172 | /* |
2173 | * If we're going to continue the lookup, we'll handle |
2174 | * all lookup-related updates at that time. |
2175 | */ |
2176 | if (error == EKEEPLOOKING) { |
2177 | return; |
2178 | } |
2179 | |
2180 | /* |
2181 | * Only audit or update cache for *found* vnodes. For creation |
2182 | * neither would happen in the non-compound-vnop case. |
2183 | */ |
2184 | if ((vp != NULLVP) && !did_create) { |
2185 | /* |
2186 | * If MAKEENTRY isn't set, and we've done a successful compound VNOP, |
2187 | * then we certainly don't want to update cache or identity. |
2188 | */ |
2189 | if ((error != 0) || (ndp->ni_cnd.cn_flags & MAKEENTRY)) { |
2190 | lookup_consider_update_cache(dvp, vp, cnp: &ndp->ni_cnd, nc_generation: ndp->ni_ncgeneration); |
2191 | } |
2192 | if (ndp->ni_cnd.cn_flags & AUDITVNPATH1) { |
2193 | AUDIT_ARG(vnpath, vp, ARG_VNODE1); |
2194 | } else if (ndp->ni_cnd.cn_flags & AUDITVNPATH2) { |
2195 | AUDIT_ARG(vnpath, vp, ARG_VNODE2); |
2196 | } |
2197 | } |
2198 | |
2199 | /* |
2200 | * If you created (whether you opened or not), cut a lookup tracepoint |
2201 | * for the parent dir (as would happen without a compound vnop). Note: we may need |
2202 | * a vnode despite failure in this case! |
2203 | * |
2204 | * If you did not create: |
2205 | * Found child (succeeded or not): cut a tracepoint for the child. |
2206 | * Did not find child: cut a tracepoint with the parent. |
2207 | */ |
2208 | if (kdebug_enable) { |
2209 | kdebug_lookup(vnp: vp ? vp : dvp, cnp: &ndp->ni_cnd); |
2210 | } |
2211 | } |
2212 | |