/*

 * CDDL HEADER START

 *

 * The contents of this file are subject to the terms of the

 * Common Development and Distribution License (the "License").

 * You may not use this file except in compliance with the License.

 *

 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 * or http://www.opensolaris.org/os/licensing.

 * See the License for the specific language governing permissions

 * and limitations under the License.

 *

 * When distributing Covered Code, include this CDDL HEADER in each

 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 * If applicable, add the following below this CDDL HEADER, with the

 * fields enclosed by brackets "[]" replaced with your own identifying

 * information: Portions Copyright [yyyy] [name of copyright owner]

 *

 * CDDL HEADER END

 */

/*

 * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.

 * Use is subject to license terms.

 */

#pragma ident	"%Z%%M%	%I%	%E% SMI"

#include <sys/types.h>

#include <sys/param.h>

#include <sys/time.h>

#include <sys/systm.h>

#include <sys/sysmacros.h>

#include <sys/resource.h>

#include <sys/vfs.h>

#include <sys/vnode.h>

#include <sys/file.h>

#include <sys/stat.h>

#include <sys/kmem.h>

#include <sys/cmn_err.h>

#include <sys/errno.h>

#include <sys/unistd.h>

#include <sys/sdt.h>

#include <sys/fs/zfs.h>

#include <sys/mode.h>

#include <sys/policy.h>

#include <sys/zfs_znode.h>

#include <sys/zfs_acl.h>

#include <sys/zfs_dir.h>

#include <sys/zfs_vfsops.h>

#include <sys/dmu.h>

#include <sys/zap.h>

#include <util/qsort.h>

#include "fs/fs_subr.h"

#include <acl/acl_common.h>

#define	ALLOW	ACE_ACCESS_ALLOWED_ACE_TYPE

#define	DENY	ACE_ACCESS_DENIED_ACE_TYPE

#define	OWNING_GROUP		(ACE_GROUP|ACE_IDENTIFIER_GROUP)

#define	EVERYONE_ALLOW_MASK (ACE_READ_ACL|ACE_READ_ATTRIBUTES | \

    ACE_READ_NAMED_ATTRS|ACE_SYNCHRONIZE)

#define	EVERYONE_DENY_MASK (ACE_WRITE_ACL|ACE_WRITE_OWNER | \

    ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS)

#define	OWNER_ALLOW_MASK (ACE_WRITE_ACL | ACE_WRITE_OWNER | \

    ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS)

#define	WRITE_MASK (ACE_WRITE_DATA|ACE_APPEND_DATA|ACE_WRITE_NAMED_ATTRS| \

    ACE_WRITE_ATTRIBUTES|ACE_WRITE_ACL|ACE_WRITE_OWNER)

#define	OGE_CLEAR	(ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \

    ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE)

#define	OKAY_MASK_BITS (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \

    ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE)

#define	ALL_INHERIT	(ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE | \

    ACE_NO_PROPAGATE_INHERIT_ACE|ACE_INHERIT_ONLY_ACE)

#define	SECURE_CLEAR	(ACE_WRITE_ACL|ACE_WRITE_OWNER)

#define	OGE_PAD	6		/* traditional owner/group/everyone ACES */

static int zfs_ace_can_use(znode_t *zp, ace_t *);

static zfs_acl_t *

zfs_acl_alloc(int slots)

{

	zfs_acl_t *aclp;

	aclp = kmem_zalloc(sizeof (zfs_acl_t), KM_SLEEP);

	if (slots != 0) {

		aclp->z_acl = kmem_alloc(ZFS_ACL_SIZE(slots), KM_SLEEP);

		aclp->z_acl_count = 0;

		aclp->z_state = ACL_DATA_ALLOCED;

	} else {

		aclp->z_state = 0;

	}

	aclp->z_slots = slots;

	return (aclp);

}

void

zfs_acl_free(zfs_acl_t *aclp)

{

	if (aclp->z_state == ACL_DATA_ALLOCED) {

		kmem_free(aclp->z_acl, ZFS_ACL_SIZE(aclp->z_slots));

	}

	kmem_free(aclp, sizeof (zfs_acl_t));

}

static uint32_t

zfs_v4_to_unix(uint32_t access_mask)

{

	uint32_t new_mask = 0;

	/*

	 * This is used for mapping v4 permissions into permissions

	 * that can be passed to secpolicy_vnode_access()

	 */

	if (access_mask & (ACE_READ_DATA | ACE_LIST_DIRECTORY |

	    ACE_READ_ATTRIBUTES | ACE_READ_ACL))

		new_mask |= S_IROTH;

	if (access_mask & (ACE_WRITE_DATA | ACE_APPEND_DATA |

	    ACE_WRITE_ATTRIBUTES | ACE_ADD_FILE | ACE_WRITE_NAMED_ATTRS))

		new_mask |= S_IWOTH;

	if (access_mask & (ACE_EXECUTE | ACE_READ_NAMED_ATTRS))

		new_mask |= S_IXOTH;

	return (new_mask);

}

/*

 * Convert unix access mask to v4 access mask

 */

static uint32_t

zfs_unix_to_v4(uint32_t access_mask)

{

	uint32_t new_mask = 0;

	if (access_mask & 01)

		new_mask |= (ACE_EXECUTE);

	if (access_mask & 02) {

		new_mask |= (ACE_WRITE_DATA);

	} if (access_mask & 04) {

		new_mask |= ACE_READ_DATA;

	}

	return (new_mask);

}

static void

zfs_set_ace(ace_t *zacep, uint32_t access_mask, int access_type,

    uid_t uid, int entry_type)

{

	zacep->a_access_mask = access_mask;

	zacep->a_type = access_type;

	zacep->a_who = uid;

	zacep->a_flags = entry_type;

}

static uint64_t

zfs_mode_compute(znode_t *zp, zfs_acl_t *aclp)

{

	int 	i;

	int	entry_type;

	mode_t	mode = (zp->z_phys->zp_mode &

	    (S_IFMT | S_ISUID | S_ISGID | S_ISVTX));

	mode_t	 seen = 0;

	ace_t 	*acep;

	for (i = 0, acep = aclp->z_acl;

	    i != aclp->z_acl_count; i++, acep++) {

		entry_type = (acep->a_flags & ACE_TYPE_FLAGS);

		if (entry_type == ACE_OWNER) {

			if ((acep->a_access_mask & ACE_READ_DATA) &&

			    (!(seen & S_IRUSR))) {

				seen |= S_IRUSR;

				if (acep->a_type == ALLOW) {

					mode |= S_IRUSR;

				}

			}

			if ((acep->a_access_mask & ACE_WRITE_DATA) &&

			    (!(seen & S_IWUSR))) {

				seen |= S_IWUSR;

				if (acep->a_type == ALLOW) {

					mode |= S_IWUSR;

				}

			}

			if ((acep->a_access_mask & ACE_EXECUTE) &&

			    (!(seen & S_IXUSR))) {

				seen |= S_IXUSR;

				if (acep->a_type == ALLOW) {

					mode |= S_IXUSR;

				}

			}

		} else if (entry_type == OWNING_GROUP) {

			if ((acep->a_access_mask & ACE_READ_DATA) &&

			    (!(seen & S_IRGRP))) {

				seen |= S_IRGRP;

				if (acep->a_type == ALLOW) {

					mode |= S_IRGRP;

				}

			}

			if ((acep->a_access_mask & ACE_WRITE_DATA) &&

			    (!(seen & S_IWGRP))) {

				seen |= S_IWGRP;

				if (acep->a_type == ALLOW) {

					mode |= S_IWGRP;

				}

			}

			if ((acep->a_access_mask & ACE_EXECUTE) &&

			    (!(seen & S_IXGRP))) {

				seen |= S_IXGRP;

				if (acep->a_type == ALLOW) {

					mode |= S_IXGRP;

				}

			}

		} else if (entry_type == ACE_EVERYONE) {

			if ((acep->a_access_mask & ACE_READ_DATA)) {

				if (!(seen & S_IRUSR)) {

					seen |= S_IRUSR;

					if (acep->a_type == ALLOW) {

						mode |= S_IRUSR;

					}

				}

				if (!(seen & S_IRGRP)) {

					seen |= S_IRGRP;

					if (acep->a_type == ALLOW) {

						mode |= S_IRGRP;

					}

				}

				if (!(seen & S_IROTH)) {

					seen |= S_IROTH;

					if (acep->a_type == ALLOW) {

						mode |= S_IROTH;

					}

				}

			}

			if ((acep->a_access_mask & ACE_WRITE_DATA)) {

				if (!(seen & S_IWUSR)) {

					seen |= S_IWUSR;

					if (acep->a_type == ALLOW) {

						mode |= S_IWUSR;

					}

				}

				if (!(seen & S_IWGRP)) {

					seen |= S_IWGRP;

					if (acep->a_type == ALLOW) {

						mode |= S_IWGRP;

					}

				}

				if (!(seen & S_IWOTH)) {

					seen |= S_IWOTH;

					if (acep->a_type == ALLOW) {

						mode |= S_IWOTH;

					}

				}

			}

			if ((acep->a_access_mask & ACE_EXECUTE)) {

				if (!(seen & S_IXUSR)) {

					seen |= S_IXUSR;

					if (acep->a_type == ALLOW) {

						mode |= S_IXUSR;

					}

				}

				if (!(seen & S_IXGRP)) {

					seen |= S_IXGRP;

					if (acep->a_type == ALLOW) {

						mode |= S_IXGRP;

					}

				}

				if (!(seen & S_IXOTH)) {

					seen |= S_IXOTH;

					if (acep->a_type == ALLOW) {

						mode |= S_IXOTH;

					}

				}

			}

		}

	}

	return (mode);

}

static zfs_acl_t *

zfs_acl_node_read_internal(znode_t *zp)

{

	zfs_acl_t	*aclp;

	aclp = zfs_acl_alloc(0);

	aclp->z_acl_count = zp->z_phys->zp_acl.z_acl_count;

	aclp->z_acl = &zp->z_phys->zp_acl.z_ace_data[0];

	return (aclp);

}

/*

 * Read an external acl object.

 */

static int

zfs_acl_node_read(znode_t *zp, zfs_acl_t **aclpp)

{

	uint64_t extacl = zp->z_phys->zp_acl.z_acl_extern_obj;

	zfs_acl_t	*aclp;

	int error;

	ASSERT(MUTEX_HELD(&zp->z_acl_lock));

	if (zp->z_phys->zp_acl.z_acl_extern_obj == 0) {

		*aclpp = zfs_acl_node_read_internal(zp);

		return (0);

	}

	aclp = zfs_acl_alloc(zp->z_phys->zp_acl.z_acl_count);

	error = dmu_read(zp->z_zfsvfs->z_os, extacl, 0,

	    ZFS_ACL_SIZE(zp->z_phys->zp_acl.z_acl_count), aclp->z_acl);

	if (error != 0) {

		zfs_acl_free(aclp);

		return (error);

	}

	aclp->z_acl_count = zp->z_phys->zp_acl.z_acl_count;

	*aclpp = aclp;

	return (0);

}

static boolean_t

zfs_acl_valid(znode_t *zp, ace_t *uace, int aclcnt, int *inherit)

{

	ace_t 	*acep;

	int i;

	*inherit = 0;

	if (aclcnt > MAX_ACL_ENTRIES || aclcnt <= 0) {

		return (B_FALSE);

	}

	for (i = 0, acep = uace; i != aclcnt; i++, acep++) {

		/*

		 * first check type of entry

		 */

		switch (acep->a_flags & ACE_TYPE_FLAGS) {

		case ACE_OWNER:

			acep->a_who = -1;

			break;

		case (ACE_IDENTIFIER_GROUP | ACE_GROUP):

		case ACE_IDENTIFIER_GROUP:

			if (acep->a_flags & ACE_GROUP) {

				acep->a_who = -1;

			}

			break;

		case ACE_EVERYONE:

			acep->a_who = -1;

			break;

		}

		/*

		 * next check inheritance level flags

		 */

		if (acep->a_type != ALLOW && acep->a_type != DENY)

			return (B_FALSE);

		/*

		 * Only directories should have inheritance flags.

		 */

		if (ZTOV(zp)->v_type != VDIR && (acep->a_flags &

		    (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE|

		    ACE_INHERIT_ONLY_ACE|ACE_NO_PROPAGATE_INHERIT_ACE))) {

			return (B_FALSE);

		}

		if (acep->a_flags &

		    (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE))

			*inherit = 1;

		if (acep->a_flags &

		    (ACE_INHERIT_ONLY_ACE|ACE_NO_PROPAGATE_INHERIT_ACE)) {

			if ((acep->a_flags & (ACE_FILE_INHERIT_ACE|

			    ACE_DIRECTORY_INHERIT_ACE)) == 0) {

				return (B_FALSE);

			}

		}

	}

	return (B_TRUE);

}

/*

 * common code for setting acl's.

 *

 * This function is called from zfs_mode_update, zfs_perm_init, and zfs_setacl.

 * zfs_setacl passes a non-NULL inherit pointer (ihp) to indicate that it's

 * already checked the acl and knows whether to inherit.

 */

int

zfs_aclset_common(znode_t *zp, zfs_acl_t *aclp, dmu_tx_t *tx, int *ihp)

{

	int 		inherit = 0;

	int		error;

	znode_phys_t	*zphys = zp->z_phys;

	zfs_znode_acl_t	*zacl = &zphys->zp_acl;

	uint32_t	acl_phys_size = ZFS_ACL_SIZE(aclp->z_acl_count);

	zfsvfs_t	*zfsvfs = zp->z_zfsvfs;

	uint64_t	aoid = zphys->zp_acl.z_acl_extern_obj;

	ASSERT(MUTEX_HELD(&zp->z_lock));

	ASSERT(MUTEX_HELD(&zp->z_acl_lock));

	if (ihp)

		inherit = *ihp;		/* already determined by caller */

	else if (!zfs_acl_valid(zp, aclp->z_acl,

	    aclp->z_acl_count, &inherit)) {

		return (EINVAL);

	}

	dmu_buf_will_dirty(zp->z_dbuf, tx);

	/*

	 * Will ACL fit internally?

	 */

	if (aclp->z_acl_count > ACE_SLOT_CNT) {

		if (aoid == 0) {

			aoid = dmu_object_alloc(zfsvfs->z_os,

			    DMU_OT_ACL, acl_phys_size, DMU_OT_NONE, 0, tx);

		} else {

			(void) dmu_object_set_blocksize(zfsvfs->z_os, aoid,

			    acl_phys_size, 0, tx);

		}

		zphys->zp_acl.z_acl_extern_obj = aoid;

		zphys->zp_acl.z_acl_count = aclp->z_acl_count;

		dmu_write(zfsvfs->z_os, aoid, 0,

		    acl_phys_size, aclp->z_acl, tx);

	} else {

		/*

		 * Migrating back embedded?

		 */

		if (zphys->zp_acl.z_acl_extern_obj) {

			error = dmu_object_free(zfsvfs->z_os,

				zp->z_phys->zp_acl.z_acl_extern_obj, tx);

			if (error)

				return (error);

			zphys->zp_acl.z_acl_extern_obj = 0;

		}

		bcopy(aclp->z_acl, zacl->z_ace_data,

		    aclp->z_acl_count * sizeof (ace_t));

		zacl->z_acl_count = aclp->z_acl_count;

	}

	zp->z_phys->zp_flags &= ~(ZFS_ACL_TRIVIAL|ZFS_INHERIT_ACE);

	if (inherit) {

		zp->z_phys->zp_flags |= ZFS_INHERIT_ACE;

	} else if (ace_trivial(zacl->z_ace_data, zacl->z_acl_count) == 0) {

		zp->z_phys->zp_flags |= ZFS_ACL_TRIVIAL;

	}

	zphys->zp_mode = zfs_mode_compute(zp, aclp);

	zfs_time_stamper_locked(zp, STATE_CHANGED, tx);

	return (0);

}

/*

 * Create space for slots_needed ACEs to be append

 * to aclp.

 */

static void

zfs_acl_append(zfs_acl_t *aclp, int slots_needed)

{

	ace_t	*newacep;

	ace_t	*oldaclp;

	int	slot_cnt;

	int 	slots_left = aclp->z_slots - aclp->z_acl_count;

	if (aclp->z_state == ACL_DATA_ALLOCED)

		ASSERT(aclp->z_slots >= aclp->z_acl_count);

	if (slots_left < slots_needed || aclp->z_state != ACL_DATA_ALLOCED) {

		slot_cnt = aclp->z_slots +  1 + (slots_needed - slots_left);

		newacep = kmem_alloc(ZFS_ACL_SIZE(slot_cnt), KM_SLEEP);

		bcopy(aclp->z_acl, newacep,

		    ZFS_ACL_SIZE(aclp->z_acl_count));

		oldaclp = aclp->z_acl;

		if (aclp->z_state == ACL_DATA_ALLOCED)

			kmem_free(oldaclp, ZFS_ACL_SIZE(aclp->z_slots));

		aclp->z_acl = newacep;

		aclp->z_slots = slot_cnt;

		aclp->z_state = ACL_DATA_ALLOCED;

	}

}

/*

 * Remove "slot" ACE from aclp

 */

static void

zfs_ace_remove(zfs_acl_t *aclp, int slot)

{

	if (aclp->z_acl_count > 1) {

		(void) memmove(&aclp->z_acl[slot],

		    &aclp->z_acl[slot +1], sizeof (ace_t) *

		    (--aclp->z_acl_count - slot));

	} else

		aclp->z_acl_count--;

}

/*

 * Update access mask for prepended ACE

 *

 * This applies the "groupmask" value for aclmode property.

 */

static void

zfs_acl_prepend_fixup(ace_t *acep, ace_t *origacep, mode_t mode, uid_t owner)

{

	int	rmask, wmask, xmask;

	int	user_ace;

	user_ace = (!(acep->a_flags &

	    (ACE_OWNER|ACE_GROUP|ACE_IDENTIFIER_GROUP)));

	if (user_ace && (acep->a_who == owner)) {

		rmask = S_IRUSR;

		wmask = S_IWUSR;

		xmask = S_IXUSR;