/*

 * CDDL HEADER START

 *

 * The contents of this file are subject to the terms of the

 * Common Development and Distribution License (the "License").

 * You may not use this file except in compliance with the License.

 *

 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 * or http://www.opensolaris.org/os/licensing.

 * See the License for the specific language governing permissions

 * and limitations under the License.

 *

 * When distributing Covered Code, include this CDDL HEADER in each

 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 * If applicable, add the following below this CDDL HEADER, with the

 * fields enclosed by brackets "[]" replaced with your own identifying

 * information: Portions Copyright [yyyy] [name of copyright owner]

 *

 * CDDL HEADER END

 */

/*

 * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.

 * Use is subject to license terms.

 */

#pragma ident	"%Z%%M%	%I%	%E% SMI"

#include <sys/types.h>

#include <sys/param.h>

#include <sys/errno.h>

#include <sys/uio.h>

#include <sys/buf.h>

#include <sys/modctl.h>

#include <sys/open.h>

#include <sys/file.h>

#include <sys/kmem.h>

#include <sys/conf.h>

#include <sys/cmn_err.h>

#include <sys/stat.h>

#include <sys/zfs_ioctl.h>

#include <sys/zap.h>

#include <sys/spa.h>

#include <sys/spa_impl.h>

#include <sys/vdev.h>

#include <sys/vdev_impl.h>

#include <sys/dmu.h>

#include <sys/dsl_dir.h>

#include <sys/dsl_dataset.h>

#include <sys/dsl_prop.h>

#include <sys/dsl_deleg.h>

#include <sys/dmu_objset.h>

#include <sys/ddi.h>

#include <sys/sunddi.h>

#include <sys/sunldi.h>

#include <sys/policy.h>

#include <sys/zone.h>

#include <sys/nvpair.h>

#include <sys/pathname.h>

#include <sys/mount.h>

#include <sys/sdt.h>

#include <sys/fs/zfs.h>

#include <sys/zfs_ctldir.h>

#include <sys/zvol.h>

#include <sharefs/share.h>

#include <sys/zfs_znode.h>

#include <sys/zfs_vfsops.h>

#include <sys/dmu_objset.h>

#include "zfs_namecheck.h"

#include "zfs_prop.h"

#include "zfs_deleg.h"

extern struct modlfs zfs_modlfs;

extern void zfs_init(void);

extern void zfs_fini(void);

ldi_ident_t zfs_li = NULL;

dev_info_t *zfs_dip;

typedef int zfs_ioc_func_t(zfs_cmd_t *);

typedef int zfs_secpolicy_func_t(zfs_cmd_t *, cred_t *);

typedef struct zfs_ioc_vec {

	zfs_ioc_func_t		*zvec_func;

	zfs_secpolicy_func_t	*zvec_secpolicy;

	enum {

		NO_NAME,

		POOL_NAME,

		DATASET_NAME

	} zvec_namecheck;

	boolean_t		zvec_his_log;

} zfs_ioc_vec_t;

/* _NOTE(PRINTFLIKE(4)) - this is printf-like, but lint is too whiney */

void

__dprintf(const char *file, const char *func, int line, const char *fmt, ...)

{

	const char *newfile;

	char buf[256];

	va_list adx;

	/*

	 * Get rid of annoying "../common/" prefix to filename.

	 */

	newfile = strrchr(file, '/');

	if (newfile != NULL) {

		newfile = newfile + 1; /* Get rid of leading / */

	} else {

		newfile = file;

	}

	va_start(adx, fmt);

	(void) vsnprintf(buf, sizeof (buf), fmt, adx);

	va_end(adx);

	/*

	 * To get this data, use the zfs-dprintf probe as so:

	 * dtrace -q -n 'zfs-dprintf \

	 *	/stringof(arg0) == "dbuf.c"/ \

	 *	{printf("%s: %s", stringof(arg1), stringof(arg3))}'

	 * arg0 = file name

	 * arg1 = function name

	 * arg2 = line number

	 * arg3 = message

	 */

	DTRACE_PROBE4(zfs__dprintf,

	    char *, newfile, char *, func, int, line, char *, buf);

}

static void

history_str_free(char *buf)

{

	kmem_free(buf, HIS_MAX_RECORD_LEN);

}

static char *

history_str_get(zfs_cmd_t *zc)

{

	char *buf;

	if (zc->zc_history == NULL)

		return (NULL);

	buf = kmem_alloc(HIS_MAX_RECORD_LEN, KM_SLEEP);

	if (copyinstr((void *)(uintptr_t)zc->zc_history,

	    buf, HIS_MAX_RECORD_LEN, NULL) != 0) {

		history_str_free(buf);

		return (NULL);

	}

	buf[HIS_MAX_RECORD_LEN -1] = '\0';

	return (buf);

}

static void

zfs_log_history(zfs_cmd_t *zc)

{

	spa_t *spa;

	char *buf;

	if ((buf = history_str_get(zc)) == NULL)

		return;

	if (spa_open(zc->zc_name, &spa, FTAG) == 0) {

		if (spa_version(spa) >= SPA_VERSION_ZPOOL_HISTORY)

			(void) spa_history_log(spa, buf, LOG_CMD_NORMAL);

		spa_close(spa, FTAG);

	}

	history_str_free(buf);

}

/*

 * Policy for top-level read operations (list pools).  Requires no privileges,

 * and can be used in the local zone, as there is no associated dataset.

 */

/* ARGSUSED */

static int

zfs_secpolicy_none(zfs_cmd_t *zc, cred_t *cr)

{

	return (0);

}

/*

 * Policy for dataset read operations (list children, get statistics).  Requires

 * no privileges, but must be visible in the local zone.

 */

/* ARGSUSED */

static int

zfs_secpolicy_read(zfs_cmd_t *zc, cred_t *cr)

{

	if (INGLOBALZONE(curproc) ||

	    zone_dataset_visible(zc->zc_name, NULL))

		return (0);

	return (ENOENT);

}

static int

zfs_dozonecheck(const char *dataset, cred_t *cr)

{

	uint64_t zoned;

	int writable = 1;

	/*

	 * The dataset must be visible by this zone -- check this first

	 * so they don't see EPERM on something they shouldn't know about.

	 */

	if (!INGLOBALZONE(curproc) &&

	    !zone_dataset_visible(dataset, &writable))

		return (ENOENT);

	if (dsl_prop_get_integer(dataset, "zoned", &zoned, NULL))

		return (ENOENT);

	if (INGLOBALZONE(curproc)) {

		/*

		 * If the fs is zoned, only root can access it from the

		 * global zone.

		 */

		if (secpolicy_zfs(cr) && zoned)

			return (EPERM);

	} else {

		/*

		 * If we are in a local zone, the 'zoned' property must be set.

		 */

		if (!zoned)

			return (EPERM);

		/* must be writable by this zone */

		if (!writable)

			return (EPERM);

	}

	return (0);

}

int

zfs_secpolicy_write_perms(const char *name, const char *perm, cred_t *cr)

{

	int error;

	error = zfs_dozonecheck(name, cr);

	if (error == 0) {

		error = secpolicy_zfs(cr);

		if (error)

			error = dsl_deleg_access(name, perm, cr);

	}

	return (error);

}

static int

zfs_secpolicy_setprop(const char *name, zfs_prop_t prop, cred_t *cr)

{

	/*

	 * Check permissions for special properties.

	 */

	switch (prop) {

	case ZFS_PROP_ZONED:

		/*

		 * Disallow setting of 'zoned' from within a local zone.

		 */

		if (!INGLOBALZONE(curproc))

			return (EPERM);

		break;

	case ZFS_PROP_QUOTA:

		if (!INGLOBALZONE(curproc)) {

			uint64_t zoned;

			char setpoint[MAXNAMELEN];

			/*

			 * Unprivileged users are allowed to modify the

			 * quota on things *under* (ie. contained by)

			 * the thing they own.

			 */

			if (dsl_prop_get_integer(name, "zoned", &zoned,

			    setpoint))

				return (EPERM);

			if (!zoned || strlen(name) <= strlen(setpoint))

				return (EPERM);

		}

		break;

	}

	return (zfs_secpolicy_write_perms(name, zfs_prop_to_name(prop), cr));

}

int

zfs_secpolicy_fsacl(zfs_cmd_t *zc, cred_t *cr)

{

	int error;

	error = zfs_dozonecheck(zc->zc_name, cr);

	if (error)

		return (error);

	/*

	 * permission to set permissions will be evaluated later in

	 * dsl_deleg_can_allow()

	 */

	return (0);

}

int

zfs_secpolicy_rollback(zfs_cmd_t *zc, cred_t *cr)

{

	int error;

	error = zfs_secpolicy_write_perms(zc->zc_name,

	    ZFS_DELEG_PERM_ROLLBACK, cr);

	if (error == 0)

		error = zfs_secpolicy_write_perms(zc->zc_name,

		    ZFS_DELEG_PERM_MOUNT, cr);

	return (error);

}

int

zfs_secpolicy_send(zfs_cmd_t *zc, cred_t *cr)

{

	return (zfs_secpolicy_write_perms(zc->zc_name,

	    ZFS_DELEG_PERM_SEND, cr));

}

int

zfs_secpolicy_share(zfs_cmd_t *zc, cred_t *cr)

{

	if (!INGLOBALZONE(curproc))

		return (EPERM);

	if (secpolicy_nfs(CRED()) == 0) {

		return (0);

	} else {

		vnode_t *vp;

		int error;

		if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,

		    NO_FOLLOW, NULL, &vp)) != 0)

			return (error);

		/* Now make sure mntpnt and dataset are ZFS */

		if (vp->v_vfsp->vfs_fstype != zfsfstype ||

		    (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),

		    zc->zc_name) != 0)) {

			VN_RELE(vp);

			return (EPERM);

		}

		VN_RELE(vp);

		return (dsl_deleg_access(zc->zc_name,

		    ZFS_DELEG_PERM_SHARE, cr));

	}

}

static int

zfs_get_parent(const char *datasetname, char *parent, int parentsize)

{

	char *cp;

	/*

	 * Remove the @bla or /bla from the end of the name to get the parent.

	 */

	(void) strncpy(parent, datasetname, parentsize);

	cp = strrchr(parent, '@');

	if (cp != NULL) {

		cp[0] = '\0';

	} else {

		cp = strrchr(parent, '/');

		if (cp == NULL)

			return (ENOENT);

		cp[0] = '\0';

	}

	return (0);

}

int

zfs_secpolicy_destroy_perms(const char *name, cred_t *cr)

{

	int error;

	if ((error = zfs_secpolicy_write_perms(name,

	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)

		return (error);

	return (zfs_secpolicy_write_perms(name, ZFS_DELEG_PERM_DESTROY, cr));

}

static int

zfs_secpolicy_destroy(zfs_cmd_t *zc, cred_t *cr)

{

	return (zfs_secpolicy_destroy_perms(zc->zc_name, cr));

}

/*

 * Must have sys_config privilege to check the iscsi permission

 */

/* ARGSUSED */

static int

zfs_secpolicy_iscsi(zfs_cmd_t *zc, cred_t *cr)

{

	return (secpolicy_zfs(cr));

}

int

zfs_secpolicy_rename_perms(const char *from, const char *to, cred_t *cr)

{

	char 	parentname[MAXNAMELEN];

	int	error;

	if ((error = zfs_secpolicy_write_perms(from,

	    ZFS_DELEG_PERM_RENAME, cr)) != 0)

		return (error);

	if ((error = zfs_secpolicy_write_perms(from,

	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)

		return (error);

	if ((error = zfs_get_parent(to, parentname,

	    sizeof (parentname))) != 0)

		return (error);

	if ((error = zfs_secpolicy_write_perms(parentname,

	    ZFS_DELEG_PERM_CREATE, cr)) != 0)

		return (error);

	if ((error = zfs_secpolicy_write_perms(parentname,

	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)

		return (error);

	return (error);

}

static int

zfs_secpolicy_rename(zfs_cmd_t *zc, cred_t *cr)

{

	return (zfs_secpolicy_rename_perms(zc->zc_name, zc->zc_value, cr));

}

static int

zfs_secpolicy_promote(zfs_cmd_t *zc, cred_t *cr)

{

	char 	parentname[MAXNAMELEN];

	objset_t *clone;

	int error;

	error = zfs_secpolicy_write_perms(zc->zc_name,

	    ZFS_DELEG_PERM_PROMOTE, cr);

	if (error)

		return (error);

	error = dmu_objset_open(zc->zc_name, DMU_OST_ANY,

	    DS_MODE_STANDARD | DS_MODE_READONLY, &clone);

	if (error == 0) {

		dsl_dataset_t *pclone = NULL;

		dsl_dir_t *dd;

		dd = clone->os->os_dsl_dataset->ds_dir;

		rw_enter(&dd->dd_pool->dp_config_rwlock, RW_READER);

		error = dsl_dataset_open_obj(dd->dd_pool,

		    dd->dd_phys->dd_clone_parent_obj, NULL,

		    DS_MODE_NONE, FTAG, &pclone);

		rw_exit(&dd->dd_pool->dp_config_rwlock);

		if (error) {

			dmu_objset_close(clone);

			return (error);

		}

		error = zfs_secpolicy_write_perms(zc->zc_name,

		    ZFS_DELEG_PERM_MOUNT, cr);

		dsl_dataset_name(pclone, parentname);

		dmu_objset_close(clone);

		dsl_dataset_close(pclone, DS_MODE_NONE, FTAG);

		if (error == 0)

			error = zfs_secpolicy_write_perms(parentname,

			    ZFS_DELEG_PERM_PROMOTE, cr);

	}

	return (error);

}

static int

zfs_secpolicy_receive(zfs_cmd_t *zc, cred_t *cr)

{