/*

 * CDDL HEADER START

 *

 * The contents of this file are subject to the terms of the

 * Common Development and Distribution License (the "License").

 * You may not use this file except in compliance with the License.

 *

 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 * or http://www.opensolaris.org/os/licensing.

 * See the License for the specific language governing permissions

 * and limitations under the License.

 *

 * When distributing Covered Code, include this CDDL HEADER in each

 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 * If applicable, add the following below this CDDL HEADER, with the

 * fields enclosed by brackets "[]" replaced with your own identifying

 * information: Portions Copyright [yyyy] [name of copyright owner]

 *

 * CDDL HEADER END

 */

/*

 * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.

 * Use is subject to license terms.

 */

#pragma ident	"%Z%%M%	%I%	%E% SMI"

#include <sys/types.h>

#include <sys/param.h>

#include <sys/errno.h>

#include <sys/uio.h>

#include <sys/buf.h>

#include <sys/modctl.h>

#include <sys/open.h>

#include <sys/file.h>

#include <sys/kmem.h>

#include <sys/conf.h>

#include <sys/cmn_err.h>

#include <sys/stat.h>

#include <sys/zfs_ioctl.h>

#include <sys/zap.h>

#include <sys/spa.h>

#include <sys/vdev.h>

#include <sys/dmu.h>

#include <sys/dsl_dir.h>

#include <sys/dsl_dataset.h>

#include <sys/dsl_prop.h>

#include <sys/ddi.h>

#include <sys/sunddi.h>

#include <sys/sunldi.h>

#include <sys/policy.h>

#include <sys/zone.h>

#include <sys/nvpair.h>

#include <sys/pathname.h>

#include <sys/mount.h>

#include <sys/sdt.h>

#include <sys/fs/zfs.h>

#include <sys/zfs_ctldir.h>

#include "zfs_namecheck.h"

extern struct modlfs zfs_modlfs;

extern void zfs_init(void);

extern void zfs_fini(void);

ldi_ident_t zfs_li = NULL;

dev_info_t *zfs_dip;

typedef int zfs_ioc_func_t(zfs_cmd_t *);

typedef int zfs_secpolicy_func_t(const char *, const char *, cred_t *);

typedef struct zfs_ioc_vec {

	zfs_ioc_func_t		*zvec_func;

	zfs_secpolicy_func_t	*zvec_secpolicy;

	enum {

		no_name,

		pool_name,

		dataset_name

	}			zvec_namecheck;

} zfs_ioc_vec_t;

/* _NOTE(PRINTFLIKE(4)) - this is printf-like, but lint is too whiney */

void

__dprintf(const char *file, const char *func, int line, const char *fmt, ...)

{

	const char *newfile;

	char buf[256];

	va_list adx;

	/*

	 * Get rid of annoying "../common/" prefix to filename.

	 */

	newfile = strrchr(file, '/');

	if (newfile != NULL) {

		newfile = newfile + 1; /* Get rid of leading / */

	} else {

		newfile = file;

	}

	va_start(adx, fmt);

	(void) vsnprintf(buf, sizeof (buf), fmt, adx);

	va_end(adx);

	/*

	 * To get this data, use the zfs-dprintf probe as so:

	 * dtrace -q -n 'zfs-dprintf \

	 *	/stringof(arg0) == "dbuf.c"/ \

	 *	{printf("%s: %s", stringof(arg1), stringof(arg3))}'

	 * arg0 = file name

	 * arg1 = function name

	 * arg2 = line number

	 * arg3 = message

	 */

	DTRACE_PROBE4(zfs__dprintf,

	    char *, newfile, char *, func, int, line, char *, buf);

}

/*

 * Policy for top-level read operations (list pools).  Requires no privileges,

 * and can be used in the local zone, as there is no associated dataset.

 */

/* ARGSUSED */

static int

zfs_secpolicy_none(const char *unused1, const char *unused2, cred_t *cr)

{

	return (0);

}

/*

 * Policy for dataset read operations (list children, get statistics).  Requires

 * no privileges, but must be visible in the local zone.

 */

/* ARGSUSED */

static int

zfs_secpolicy_read(const char *dataset, const char *unused, cred_t *cr)

{

	if (INGLOBALZONE(curproc) ||

	    zone_dataset_visible(dataset, NULL))

		return (0);

	return (ENOENT);

}

static int

zfs_dozonecheck(const char *dataset, cred_t *cr)

{

	uint64_t zoned;

	int writable = 1;

	/*

	 * The dataset must be visible by this zone -- check this first

	 * so they don't see EPERM on something they shouldn't know about.

	 */

	if (!INGLOBALZONE(curproc) &&

	    !zone_dataset_visible(dataset, &writable))

		return (ENOENT);

	if (dsl_prop_get_integer(dataset, "zoned", &zoned, NULL))

		return (ENOENT);

	if (INGLOBALZONE(curproc)) {

		/*

		 * If the fs is zoned, only root can access it from the

		 * global zone.

		 */

		if (secpolicy_zfs(cr) && zoned)

			return (EPERM);

	} else {

		/*

		 * If we are in a local zone, the 'zoned' property must be set.

		 */

		if (!zoned)

			return (EPERM);

		/* must be writable by this zone */

		if (!writable)

			return (EPERM);

	}

	return (0);

}

/*

 * Policy for dataset write operations (create children, set properties, etc).

 * Requires SYS_MOUNT privilege, and must be writable in the local zone.

 */

/* ARGSUSED */

int

zfs_secpolicy_write(const char *dataset, const char *unused, cred_t *cr)

{

	int error;

	if (error = zfs_dozonecheck(dataset, cr))

		return (error);

	return (secpolicy_zfs(cr));

}

/*

 * Policy for operations that want to write a dataset's parent:

 * create, destroy, snapshot, clone, restore.

 */

static int

zfs_secpolicy_parent(const char *dataset, const char *unused, cred_t *cr)

{

	char parentname[MAXNAMELEN];

	char *cp;

	/*

	 * Remove the @bla or /bla from the end of the name to get the parent.

	 */

	(void) strncpy(parentname, dataset, sizeof (parentname));

	cp = strrchr(parentname, '@');

	if (cp != NULL) {

		cp[0] = '\0';

	} else {

		cp = strrchr(parentname, '/');

		if (cp == NULL)

			return (ENOENT);

		cp[0] = '\0';

	}

	return (zfs_secpolicy_write(parentname, unused, cr));

}

/*

 * Policy for dataset write operations (create children, set properties, etc).

 * Requires SYS_MOUNT privilege, and must be writable in the local zone.

 */

static int

zfs_secpolicy_setprop(const char *dataset, const char *prop, cred_t *cr)

{

	int error;

	if (error = zfs_dozonecheck(dataset, cr))

		return (error);

	if (strcmp(prop, "zoned") == 0) {

		/*

		 * Disallow setting of 'zoned' from within a local zone.

		 */

		if (!INGLOBALZONE(curproc))

			return (EPERM);

	}

	return (secpolicy_zfs(cr));

}

/*

 * Security policy for setting the quota.  This is the same as

 * zfs_secpolicy_write, except that the local zone may not change the quota at

 * the zone-property setpoint.

 */

/* ARGSUSED */

static int

zfs_secpolicy_quota(const char *dataset, const char *unused, cred_t *cr)

{

	int error;

	if (error = zfs_dozonecheck(dataset, cr))

		return (error);

	if (!INGLOBALZONE(curproc)) {

		uint64_t zoned;

		char setpoint[MAXNAMELEN];

		int dslen;

		/*

		 * Unprivileged users are allowed to modify the quota

		 * on things *under* (ie. contained by) the thing they

		 * own.

		 */

		if (dsl_prop_get_integer(dataset, "zoned", &zoned, setpoint))

			return (EPERM);

		if (!zoned) /* this shouldn't happen */

			return (EPERM);

		dslen = strlen(dataset);

		if (dslen <= strlen(setpoint))

			return (EPERM);

	}

	return (secpolicy_zfs(cr));

}

/*

 * Policy for pool operations - create/destroy pools, add vdevs, etc.  Requires

 * SYS_CONFIG privilege, which is not available in a local zone.

 */

/* ARGSUSED */

static int

zfs_secpolicy_config(const char *unused, const char *unused2, cred_t *cr)

{

	if (secpolicy_sys_config(cr, B_FALSE) != 0)

		return (EPERM);

	return (0);

}

/*

 * Policy for fault injection.  Requires all privileges.

 */

/* ARGSUSED */

static int

zfs_secpolicy_inject(const char *unused, const char *unused2, cred_t *cr)

{

	return (secpolicy_zinject(cr));

}

/*

 * Returns the nvlist as specified by the user in the zfs_cmd_t.

 */

static int

get_config(zfs_cmd_t *zc, nvlist_t **nvp)

{

	char *packed;

	size_t size;

	int error;

	nvlist_t *config = NULL;

	/*

	 * Read in and unpack the user-supplied nvlist.  By this point, we know

	 * that the user has the SYS_CONFIG privilege, so allocating arbitrary

	 * sized regions of memory should not be a problem.

	 */

	if ((size = zc->zc_config_src_size) == 0)

		return (EINVAL);

	packed = kmem_alloc(size, KM_SLEEP);

	if ((error = xcopyin((void *)(uintptr_t)zc->zc_config_src, packed,

	    size)) != 0) {

		kmem_free(packed, size);

		return (error);

	}

	if ((error = nvlist_unpack(packed, size, &config, 0)) != 0) {

		kmem_free(packed, size);

		return (error);

	}

	kmem_free(packed, size);

	*nvp = config;

	return (0);

}

static int

zfs_ioc_pool_create(zfs_cmd_t *zc)

{

	int error;

	nvlist_t *config;

	if ((error = get_config(zc, &config)) != 0)

		return (error);

	error = spa_create(zc->zc_name, config, zc->zc_root[0] == '\0' ?

	    NULL : zc->zc_root);

	nvlist_free(config);

	return (error);

}

static int

zfs_ioc_pool_destroy(zfs_cmd_t *zc)

{

	return (spa_destroy(zc->zc_name));

}

static int

zfs_ioc_pool_import(zfs_cmd_t *zc)

{

	int error;

	nvlist_t *config;

	uint64_t guid;

	if ((error = get_config(zc, &config)) != 0)

		return (error);

	if (nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_GUID, &guid) != 0 ||

	    guid != zc->zc_guid)

		error = EINVAL;

	else

		error = spa_import(zc->zc_name, config,

		    zc->zc_root[0] == '\0' ? NULL : zc->zc_root);

	nvlist_free(config);

	return (error);

}

static int

zfs_ioc_pool_export(zfs_cmd_t *zc)

{

	return (spa_export(zc->zc_name));

}

static int

zfs_ioc_pool_configs(zfs_cmd_t *zc)

{

	nvlist_t *configs;

	char *packed = NULL;

	size_t size = 0;

	int error;

	if ((configs = spa_all_configs(&zc->zc_cookie)) == NULL)

		return (EEXIST);

	VERIFY(nvlist_pack(configs, &packed, &size, NV_ENCODE_NATIVE,

	    KM_SLEEP) == 0);

	if (size > zc->zc_config_dst_size)

		error = ENOMEM;

	else

		error = xcopyout(packed, (void *)(uintptr_t)zc->zc_config_dst,

		    size);

	zc->zc_config_dst_size = size;

	kmem_free(packed, size);

	nvlist_free(configs);

	return (error);

}

static int

zfs_ioc_pool_guid(zfs_cmd_t *zc)

{

	spa_t *spa;

	int error;

	error = spa_open(zc->zc_name, &spa, FTAG);

	if (error == 0) {

		zc->zc_guid = spa_guid(spa);

		spa_close(spa, FTAG);

	}

	return (error);

}

static int

zfs_ioc_pool_stats(zfs_cmd_t *zc)

{

	nvlist_t *config;

	char *packed = NULL;

	size_t size = 0;

	int error;

	int ret = 0;

	error = spa_get_stats(zc->zc_name, &config, zc->zc_root,

	    sizeof (zc->zc_root));

	if (config != NULL) {

		VERIFY(nvlist_pack(config, &packed, &size,

		    NV_ENCODE_NATIVE, KM_SLEEP) == 0);

		if (size > zc->zc_config_dst_size)

			ret = ENOMEM;

		else if (xcopyout(packed, (void *)(uintptr_t)zc->zc_config_dst,

		    size))

			ret = EFAULT;

		zc->zc_config_dst_size = size;

		kmem_free(packed, size);

		nvlist_free(config);

		/*

		 * The config may be present even if 'error' is non-zero.

		 * In this case we return success, and preserve the real errno

		 * in 'zc_cookie'.

		 */

		zc->zc_cookie = error;

	} else {

		ret = error;

	}

	return (ret);

}

/*

 * Try to import the given pool, returning pool stats as appropriate so that

 * user land knows which devices are available and overall pool health.

 */

static int

zfs_ioc_pool_tryimport(zfs_cmd_t *zc)

{

	nvlist_t *tryconfig, *config;

	char *packed = NULL;

	size_t size = 0;

	int error;

	if ((error = get_config(zc, &tryconfig)) != 0)

		return (error);

	config = spa_tryimport(tryconfig);

	nvlist_free(tryconfig);

	if (config == NULL)

		return (EINVAL);

	VERIFY(nvlist_pack(config, &packed, &size, NV_ENCODE_NATIVE,

	    KM_SLEEP) == 0);

	if (size > zc->zc_config_dst_size)

		error = ENOMEM;

	else

		error = xcopyout(packed, (void *)(uintptr_t)zc->zc_config_dst,

		    size);

	zc->zc_config_dst_size = size;

	kmem_free(packed, size);

	nvlist_free(config);

	return (error);

}

static int

zfs_ioc_pool_scrub(zfs_cmd_t *zc)

{

	spa_t *spa;

	int error;