/*

 * CDDL HEADER START

 *

 * The contents of this file are subject to the terms of the

 * Common Development and Distribution License (the "License").

 * You may not use this file except in compliance with the License.

 *

 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 * or http://www.opensolaris.org/os/licensing.

 * See the License for the specific language governing permissions

 * and limitations under the License.

 *

 * When distributing Covered Code, include this CDDL HEADER in each

 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 * If applicable, add the following below this CDDL HEADER, with the

 * fields enclosed by brackets "[]" replaced with your own identifying

 * information: Portions Copyright [yyyy] [name of copyright owner]

 *

 * CDDL HEADER END

 */

/*

 * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.

 * Portions Copyright 2011 Martin Matuska

 * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.

 * Copyright (c) 2012, Joyent, Inc. All rights reserved.

 * Copyright (c) 2013 by Delphix. All rights reserved.

 * Copyright (c) 2013 by Saso Kiselkov. All rights reserved.

 * Copyright (c) 2013 Steven Hartland. All rights reserved.

 */

/*

 * ZFS ioctls.

 *

 * This file handles the ioctls to /dev/zfs, used for configuring ZFS storage

 * pools and filesystems, e.g. with /sbin/zfs and /sbin/zpool.

 *

 * There are two ways that we handle ioctls: the legacy way where almost

 * all of the logic is in the ioctl callback, and the new way where most

 * of the marshalling is handled in the common entry point, zfsdev_ioctl().

 *

 * Non-legacy ioctls should be registered by calling

 * zfs_ioctl_register() from zfs_ioctl_init().  The ioctl is invoked

 * from userland by lzc_ioctl().

 *

 * The registration arguments are as follows:

 *

 * const char *name

 *   The name of the ioctl.  This is used for history logging.  If the

 *   ioctl returns successfully (the callback returns 0), and allow_log

 *   is true, then a history log entry will be recorded with the input &

 *   output nvlists.  The log entry can be printed with "zpool history -i".

 *

 * zfs_ioc_t ioc

 *   The ioctl request number, which userland will pass to ioctl(2).

 *   The ioctl numbers can change from release to release, because

 *   the caller (libzfs) must be matched to the kernel.

 *

 * zfs_secpolicy_func_t *secpolicy

 *   This function will be called before the zfs_ioc_func_t, to

 *   determine if this operation is permitted.  It should return EPERM

 *   on failure, and 0 on success.  Checks include determining if the

 *   dataset is visible in this zone, and if the user has either all

 *   zfs privileges in the zone (SYS_MOUNT), or has been granted permission

 *   to do this operation on this dataset with "zfs allow".

 *

 * zfs_ioc_namecheck_t namecheck

 *   This specifies what to expect in the zfs_cmd_t:zc_name -- a pool

 *   name, a dataset name, or nothing.  If the name is not well-formed,

 *   the ioctl will fail and the callback will not be called.

 *   Therefore, the callback can assume that the name is well-formed

 *   (e.g. is null-terminated, doesn't have more than one '@' character,

 *   doesn't have invalid characters).

 *

 * zfs_ioc_poolcheck_t pool_check

 *   This specifies requirements on the pool state.  If the pool does

 *   not meet them (is suspended or is readonly), the ioctl will fail

 *   and the callback will not be called.  If any checks are specified

 *   (i.e. it is not POOL_CHECK_NONE), namecheck must not be NO_NAME.

 *   Multiple checks can be or-ed together (e.g. POOL_CHECK_SUSPENDED |

 *   POOL_CHECK_READONLY).

 *

 * boolean_t smush_outnvlist

 *   If smush_outnvlist is true, then the output is presumed to be a

 *   list of errors, and it will be "smushed" down to fit into the

 *   caller's buffer, by removing some entries and replacing them with a

 *   single "N_MORE_ERRORS" entry indicating how many were removed.  See

 *   nvlist_smush() for details.  If smush_outnvlist is false, and the

 *   outnvlist does not fit into the userland-provided buffer, then the

 *   ioctl will fail with ENOMEM.

 *

 * zfs_ioc_func_t *func

 *   The callback function that will perform the operation.

 *

 *   The callback should return 0 on success, or an error number on

 *   failure.  If the function fails, the userland ioctl will return -1,

 *   and errno will be set to the callback's return value.  The callback

 *   will be called with the following arguments:

 *

 *   const char *name

 *     The name of the pool or dataset to operate on, from

 *     zfs_cmd_t:zc_name.  The 'namecheck' argument specifies the

 *     expected type (pool, dataset, or none).

 *

 *   nvlist_t *innvl

 *     The input nvlist, deserialized from zfs_cmd_t:zc_nvlist_src.  Or

 *     NULL if no input nvlist was provided.  Changes to this nvlist are

 *     ignored.  If the input nvlist could not be deserialized, the

 *     ioctl will fail and the callback will not be called.

 *

 *   nvlist_t *outnvl

 *     The output nvlist, initially empty.  The callback can fill it in,

 *     and it will be returned to userland by serializing it into

 *     zfs_cmd_t:zc_nvlist_dst.  If it is non-empty, and serialization

 *     fails (e.g. because the caller didn't supply a large enough

 *     buffer), then the overall ioctl will fail.  See the

 *     'smush_nvlist' argument above for additional behaviors.

 *

 *     There are two typical uses of the output nvlist:

 *       - To return state, e.g. property values.  In this case,

 *         smush_outnvlist should be false.  If the buffer was not large

 *         enough, the caller will reallocate a larger buffer and try

 *         the ioctl again.

 *

 *       - To return multiple errors from an ioctl which makes on-disk

 *         changes.  In this case, smush_outnvlist should be true.

 *         Ioctls which make on-disk modifications should generally not

 *         use the outnvl if they succeed, because the caller can not

 *         distinguish between the operation failing, and

 *         deserialization failing.

 */

#include <sys/types.h>

#include <sys/param.h>

#include <sys/errno.h>

#include <sys/uio.h>

#include <sys/buf.h>

#include <sys/modctl.h>

#include <sys/open.h>

#include <sys/file.h>

#include <sys/kmem.h>

#include <sys/conf.h>

#include <sys/cmn_err.h>

#include <sys/stat.h>

#include <sys/zfs_ioctl.h>

#include <sys/zfs_vfsops.h>

#include <sys/zfs_znode.h>

#include <sys/zap.h>

#include <sys/spa.h>

#include <sys/spa_impl.h>

#include <sys/vdev.h>

#include <sys/priv_impl.h>

#include <sys/dmu.h>

#include <sys/dsl_dir.h>

#include <sys/dsl_dataset.h>

#include <sys/dsl_prop.h>

#include <sys/dsl_deleg.h>

#include <sys/dmu_objset.h>

#include <sys/dmu_impl.h>

#include <sys/dmu_tx.h>

#include <sys/ddi.h>

#include <sys/sunddi.h>

#include <sys/sunldi.h>

#include <sys/policy.h>

#include <sys/zone.h>

#include <sys/nvpair.h>

#include <sys/pathname.h>

#include <sys/mount.h>

#include <sys/sdt.h>

#include <sys/fs/zfs.h>

#include <sys/zfs_ctldir.h>

#include <sys/zfs_dir.h>

#include <sys/zfs_onexit.h>

#include <sys/zvol.h>

#include <sys/dsl_scan.h>

#include <sharefs/share.h>

#include <sys/dmu_objset.h>

#include <sys/dmu_send.h>

#include <sys/dsl_destroy.h>

#include <sys/dsl_userhold.h>

#include <sys/zfeature.h>

#include "zfs_namecheck.h"

#include "zfs_prop.h"

#include "zfs_deleg.h"

#include "zfs_comutil.h"

extern struct modlfs zfs_modlfs;

extern void zfs_init(void);

extern void zfs_fini(void);

ldi_ident_t zfs_li = NULL;

dev_info_t *zfs_dip;

uint_t zfs_fsyncer_key;

extern uint_t rrw_tsd_key;

static uint_t zfs_allow_log_key;

typedef int zfs_ioc_legacy_func_t(zfs_cmd_t *);

typedef int zfs_ioc_func_t(const char *, nvlist_t *, nvlist_t *);

typedef int zfs_secpolicy_func_t(zfs_cmd_t *, nvlist_t *, cred_t *);

typedef enum {

	NO_NAME,

	POOL_NAME,

	DATASET_NAME

} zfs_ioc_namecheck_t;

typedef enum {

	POOL_CHECK_NONE		= 1 << 0,

	POOL_CHECK_SUSPENDED	= 1 << 1,

	POOL_CHECK_READONLY	= 1 << 2,

} zfs_ioc_poolcheck_t;

typedef struct zfs_ioc_vec {

	zfs_ioc_legacy_func_t	*zvec_legacy_func;

	zfs_ioc_func_t		*zvec_func;

	zfs_secpolicy_func_t	*zvec_secpolicy;

	zfs_ioc_namecheck_t	zvec_namecheck;

	boolean_t		zvec_allow_log;

	zfs_ioc_poolcheck_t	zvec_pool_check;

	boolean_t		zvec_smush_outnvlist;

	const char		*zvec_name;

} zfs_ioc_vec_t;

/* This array is indexed by zfs_userquota_prop_t */

static const char *userquota_perms[] = {

	ZFS_DELEG_PERM_USERUSED,

	ZFS_DELEG_PERM_USERQUOTA,

	ZFS_DELEG_PERM_GROUPUSED,

	ZFS_DELEG_PERM_GROUPQUOTA,

};

static int zfs_ioc_userspace_upgrade(zfs_cmd_t *zc);

static int zfs_check_settable(const char *name, nvpair_t *property,

    cred_t *cr);

static int zfs_check_clearable(char *dataset, nvlist_t *props,

    nvlist_t **errors);

static int zfs_fill_zplprops_root(uint64_t, nvlist_t *, nvlist_t *,

    boolean_t *);

int zfs_set_prop_nvlist(const char *, zprop_source_t, nvlist_t *, nvlist_t *);

static int get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp);

static int zfs_prop_activate_feature(spa_t *spa, zfeature_info_t *feature);

/* _NOTE(PRINTFLIKE(4)) - this is printf-like, but lint is too whiney */

void

__dprintf(const char *file, const char *func, int line, const char *fmt, ...)

{

	const char *newfile;

	char buf[512];

	va_list adx;

	/*

	 * Get rid of annoying "../common/" prefix to filename.

	 */

	newfile = strrchr(file, '/');

	if (newfile != NULL) {

		newfile = newfile + 1; /* Get rid of leading / */

	} else {

		newfile = file;

	}

	va_start(adx, fmt);

	(void) vsnprintf(buf, sizeof (buf), fmt, adx);

	va_end(adx);

	/*

	 * To get this data, use the zfs-dprintf probe as so:

	 * dtrace -q -n 'zfs-dprintf \

	 *	/stringof(arg0) == "dbuf.c"/ \

	 *	{printf("%s: %s", stringof(arg1), stringof(arg3))}'

	 * arg0 = file name

	 * arg1 = function name

	 * arg2 = line number

	 * arg3 = message

	 */

	DTRACE_PROBE4(zfs__dprintf,

	    char *, newfile, char *, func, int, line, char *, buf);

}

static void

history_str_free(char *buf)

{

	kmem_free(buf, HIS_MAX_RECORD_LEN);

}

static char *

history_str_get(zfs_cmd_t *zc)

{

	char *buf;

	if (zc->zc_history == NULL)

		return (NULL);

	buf = kmem_alloc(HIS_MAX_RECORD_LEN, KM_SLEEP);

	if (copyinstr((void *)(uintptr_t)zc->zc_history,

	    buf, HIS_MAX_RECORD_LEN, NULL) != 0) {

		history_str_free(buf);

		return (NULL);

	}

	buf[HIS_MAX_RECORD_LEN -1] = '\0';

	return (buf);

}

/*

 * Check to see if the named dataset is currently defined as bootable

 */

static boolean_t

zfs_is_bootfs(const char *name)

{

	objset_t *os;

	if (dmu_objset_hold(name, FTAG, &os) == 0) {

		boolean_t ret;

		ret = (dmu_objset_id(os) == spa_bootfs(dmu_objset_spa(os)));

		dmu_objset_rele(os, FTAG);

		return (ret);

	}

	return (B_FALSE);

}

/*

 * Return non-zero if the spa version is less than requested version.

 */

static int

zfs_earlier_version(const char *name, int version)

{

	spa_t *spa;

	if (spa_open(name, &spa, FTAG) == 0) {

		if (spa_version(spa) < version) {

			spa_close(spa, FTAG);

			return (1);

		}

		spa_close(spa, FTAG);

	}

	return (0);

}

/*

 * Return TRUE if the ZPL version is less than requested version.

 */

static boolean_t

zpl_earlier_version(const char *name, int version)

{

	objset_t *os;

	boolean_t rc = B_TRUE;

	if (dmu_objset_hold(name, FTAG, &os) == 0) {

		uint64_t zplversion;

		if (dmu_objset_type(os) != DMU_OST_ZFS) {

			dmu_objset_rele(os, FTAG);

			return (B_TRUE);

		}

		/* XXX reading from non-owned objset */

		if (zfs_get_zplprop(os, ZFS_PROP_VERSION, &zplversion) == 0)

			rc = zplversion < version;

		dmu_objset_rele(os, FTAG);

	}

	return (rc);

}

static void

zfs_log_history(zfs_cmd_t *zc)

{

	spa_t *spa;

	char *buf;

	if ((buf = history_str_get(zc)) == NULL)

		return;

	if (spa_open(zc->zc_name, &spa, FTAG) == 0) {

		if (spa_version(spa) >= SPA_VERSION_ZPOOL_HISTORY)

			(void) spa_history_log(spa, buf);

		spa_close(spa, FTAG);

	}

	history_str_free(buf);

}

/*

 * Policy for top-level read operations (list pools).  Requires no privileges,

 * and can be used in the local zone, as there is no associated dataset.

 */

/* ARGSUSED */

static int

zfs_secpolicy_none(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)

{

	return (0);

}

/*

 * Policy for dataset read operations (list children, get statistics).  Requires

 * no privileges, but must be visible in the local zone.

 */

/* ARGSUSED */

static int

zfs_secpolicy_read(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)

{

	if (INGLOBALZONE(curproc) ||

	    zone_dataset_visible(zc->zc_name, NULL))

		return (0);

	return (SET_ERROR(ENOENT));

}

static int

zfs_dozonecheck_impl(const char *dataset, uint64_t zoned, cred_t *cr)

{

	int writable = 1;

	/*

	 * The dataset must be visible by this zone -- check this first

	 * so they don't see EPERM on something they shouldn't know about.

	 */

	if (!INGLOBALZONE(curproc) &&

	    !zone_dataset_visible(dataset, &writable))

		return (SET_ERROR(ENOENT));

	if (INGLOBALZONE(curproc)) {

		/*

		 * If the fs is zoned, only root can access it from the

		 * global zone.

		 */

		if (secpolicy_zfs(cr) && zoned)

			return (SET_ERROR(EPERM));

	} else {

		/*

		 * If we are in a local zone, the 'zoned' property must be set.

		 */

		if (!zoned)

			return (SET_ERROR(EPERM));

		/* must be writable by this zone */

		if (!writable)

			return (SET_ERROR(EPERM));

	}

	return (0);

}

static int

zfs_dozonecheck(const char *dataset, cred_t *cr)

{

	uint64_t zoned;

	if (dsl_prop_get_integer(dataset, "zoned", &zoned, NULL))

		return (SET_ERROR(ENOENT));

	return (zfs_dozonecheck_impl(dataset, zoned, cr));

}

static int

zfs_dozonecheck_ds(const char *dataset, dsl_dataset_t *ds, cred_t *cr)

{

	uint64_t zoned;

	if (dsl_prop_get_int_ds(ds, "zoned", &zoned))

		return (SET_ERROR(ENOENT));

	return (zfs_dozonecheck_impl(dataset, zoned, cr));

}

static int

zfs_secpolicy_write_perms_ds(const char *name, dsl_dataset_t *ds,

    const char *perm, cred_t *cr)

{

	int error;

	error = zfs_dozonecheck_ds(name, ds, cr);

	if (error == 0) {

		error = secpolicy_zfs(cr);

		if (error != 0)

			error = dsl_deleg_access_impl(ds, perm, cr);

	}

	return (error);

}

static int

zfs_secpolicy_write_perms(const char *name, const char *perm, cred_t *cr)

{

	int error;

	dsl_dataset_t *ds;

	dsl_pool_t *dp;

	error = dsl_pool_hold(name, FTAG, &dp);

	if (error != 0)

		return (error);

	error = dsl_dataset_hold(dp, name, FTAG, &ds);

	if (error != 0) {

		dsl_pool_rele(dp, FTAG);

		return (error);