/*

 * CDDL HEADER START

 *

 * The contents of this file are subject to the terms of the

 * Common Development and Distribution License (the "License").

 * You may not use this file except in compliance with the License.

 *

 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 * or http://www.opensolaris.org/os/licensing.

 * See the License for the specific language governing permissions

 * and limitations under the License.

 *

 * When distributing Covered Code, include this CDDL HEADER in each

 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 * If applicable, add the following below this CDDL HEADER, with the

 * fields enclosed by brackets "[]" replaced with your own identifying

 * information: Portions Copyright [yyyy] [name of copyright owner]

 *

 * CDDL HEADER END

 */

/*

 * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.

 * Portions Copyright 2011 Martin Matuska

 */

#include <sys/types.h>

#include <sys/param.h>

#include <sys/errno.h>

#include <sys/uio.h>

#include <sys/buf.h>

#include <sys/modctl.h>

#include <sys/open.h>

#include <sys/file.h>

#include <sys/kmem.h>

#include <sys/conf.h>

#include <sys/cmn_err.h>

#include <sys/stat.h>

#include <sys/zfs_ioctl.h>

#include <sys/zfs_vfsops.h>

#include <sys/zfs_znode.h>

#include <sys/zap.h>

#include <sys/spa.h>

#include <sys/spa_impl.h>

#include <sys/vdev.h>

#include <sys/priv_impl.h>

#include <sys/dmu.h>

#include <sys/dsl_dir.h>

#include <sys/dsl_dataset.h>

#include <sys/dsl_prop.h>

#include <sys/dsl_deleg.h>

#include <sys/dmu_objset.h>

#include <sys/ddi.h>

#include <sys/sunddi.h>

#include <sys/sunldi.h>

#include <sys/policy.h>

#include <sys/zone.h>

#include <sys/nvpair.h>

#include <sys/pathname.h>

#include <sys/mount.h>

#include <sys/sdt.h>

#include <sys/fs/zfs.h>

#include <sys/zfs_ctldir.h>

#include <sys/zfs_dir.h>

#include <sys/zfs_onexit.h>

#include <sys/zvol.h>

#include <sys/dsl_scan.h>

#include <sharefs/share.h>

#include <sys/dmu_objset.h>

#include "zfs_namecheck.h"

#include "zfs_prop.h"

#include "zfs_deleg.h"

#include "zfs_comutil.h"

extern struct modlfs zfs_modlfs;

extern void zfs_init(void);

extern void zfs_fini(void);

ldi_ident_t zfs_li = NULL;

dev_info_t *zfs_dip;

typedef int zfs_ioc_func_t(zfs_cmd_t *);

typedef int zfs_secpolicy_func_t(zfs_cmd_t *, cred_t *);

typedef enum {

	NO_NAME,

	POOL_NAME,

	DATASET_NAME

} zfs_ioc_namecheck_t;

typedef enum {

	POOL_CHECK_NONE		= 1 << 0,

	POOL_CHECK_SUSPENDED	= 1 << 1,

	POOL_CHECK_READONLY	= 1 << 2

} zfs_ioc_poolcheck_t;

typedef struct zfs_ioc_vec {

	zfs_ioc_func_t		*zvec_func;

	zfs_secpolicy_func_t	*zvec_secpolicy;

	zfs_ioc_namecheck_t	zvec_namecheck;

	boolean_t		zvec_his_log;

	zfs_ioc_poolcheck_t	zvec_pool_check;

} zfs_ioc_vec_t;

/* This array is indexed by zfs_userquota_prop_t */

static const char *userquota_perms[] = {

	ZFS_DELEG_PERM_USERUSED,

	ZFS_DELEG_PERM_USERQUOTA,

	ZFS_DELEG_PERM_GROUPUSED,

	ZFS_DELEG_PERM_GROUPQUOTA,

};

static int zfs_ioc_userspace_upgrade(zfs_cmd_t *zc);

static int zfs_check_settable(const char *name, nvpair_t *property,

    cred_t *cr);

static int zfs_check_clearable(char *dataset, nvlist_t *props,

    nvlist_t **errors);

static int zfs_fill_zplprops_root(uint64_t, nvlist_t *, nvlist_t *,

    boolean_t *);

int zfs_set_prop_nvlist(const char *, zprop_source_t, nvlist_t *, nvlist_t **);

/* _NOTE(PRINTFLIKE(4)) - this is printf-like, but lint is too whiney */

void

__dprintf(const char *file, const char *func, int line, const char *fmt, ...)

{

	const char *newfile;

	char buf[512];

	va_list adx;

	/*

	 * Get rid of annoying "../common/" prefix to filename.

	 */

	newfile = strrchr(file, '/');

	if (newfile != NULL) {

		newfile = newfile + 1; /* Get rid of leading / */

	} else {

		newfile = file;

	}

	va_start(adx, fmt);

	(void) vsnprintf(buf, sizeof (buf), fmt, adx);

	va_end(adx);

	/*

	 * To get this data, use the zfs-dprintf probe as so:

	 * dtrace -q -n 'zfs-dprintf \

	 *	/stringof(arg0) == "dbuf.c"/ \

	 *	{printf("%s: %s", stringof(arg1), stringof(arg3))}'

	 * arg0 = file name

	 * arg1 = function name

	 * arg2 = line number

	 * arg3 = message

	 */

	DTRACE_PROBE4(zfs__dprintf,

	    char *, newfile, char *, func, int, line, char *, buf);

}

static void

history_str_free(char *buf)

{

	kmem_free(buf, HIS_MAX_RECORD_LEN);

}

static char *

history_str_get(zfs_cmd_t *zc)

{

	char *buf;

	if (zc->zc_history == NULL)

		return (NULL);

	buf = kmem_alloc(HIS_MAX_RECORD_LEN, KM_SLEEP);

	if (copyinstr((void *)(uintptr_t)zc->zc_history,

	    buf, HIS_MAX_RECORD_LEN, NULL) != 0) {

		history_str_free(buf);

		return (NULL);

	}

	buf[HIS_MAX_RECORD_LEN -1] = '\0';

	return (buf);

}

/*

 * Check to see if the named dataset is currently defined as bootable

 */

static boolean_t

zfs_is_bootfs(const char *name)

{

	objset_t *os;

	if (dmu_objset_hold(name, FTAG, &os) == 0) {

		boolean_t ret;

		ret = (dmu_objset_id(os) == spa_bootfs(dmu_objset_spa(os)));

		dmu_objset_rele(os, FTAG);

		return (ret);

	}

	return (B_FALSE);

}

/*

 * zfs_earlier_version

 *

 *	Return non-zero if the spa version is less than requested version.

 */

static int

zfs_earlier_version(const char *name, int version)

{

	spa_t *spa;

	if (spa_open(name, &spa, FTAG) == 0) {

		if (spa_version(spa) < version) {

			spa_close(spa, FTAG);

			return (1);

		}

		spa_close(spa, FTAG);

	}

	return (0);

}

/*

 * zpl_earlier_version

 *

 * Return TRUE if the ZPL version is less than requested version.

 */

static boolean_t

zpl_earlier_version(const char *name, int version)

{

	objset_t *os;

	boolean_t rc = B_TRUE;

	if (dmu_objset_hold(name, FTAG, &os) == 0) {

		uint64_t zplversion;

		if (dmu_objset_type(os) != DMU_OST_ZFS) {

			dmu_objset_rele(os, FTAG);

			return (B_TRUE);

		}

		/* XXX reading from non-owned objset */

		if (zfs_get_zplprop(os, ZFS_PROP_VERSION, &zplversion) == 0)

			rc = zplversion < version;

		dmu_objset_rele(os, FTAG);

	}

	return (rc);

}

static void

zfs_log_history(zfs_cmd_t *zc)

{

	spa_t *spa;

	char *buf;

	if ((buf = history_str_get(zc)) == NULL)

		return;

	if (spa_open(zc->zc_name, &spa, FTAG) == 0) {

		if (spa_version(spa) >= SPA_VERSION_ZPOOL_HISTORY)

			(void) spa_history_log(spa, buf, LOG_CMD_NORMAL);

		spa_close(spa, FTAG);

	}

	history_str_free(buf);

}

/*

 * Policy for top-level read operations (list pools).  Requires no privileges,

 * and can be used in the local zone, as there is no associated dataset.

 */

/* ARGSUSED */

static int

zfs_secpolicy_none(zfs_cmd_t *zc, cred_t *cr)

{

	return (0);

}

/*

 * Policy for dataset read operations (list children, get statistics).  Requires

 * no privileges, but must be visible in the local zone.

 */

/* ARGSUSED */

static int

zfs_secpolicy_read(zfs_cmd_t *zc, cred_t *cr)

{

	if (INGLOBALZONE(curproc) ||

	    zone_dataset_visible(zc->zc_name, NULL))

		return (0);

	return (ENOENT);

}

static int

zfs_dozonecheck_impl(const char *dataset, uint64_t zoned, cred_t *cr)

{

	int writable = 1;

	/*

	 * The dataset must be visible by this zone -- check this first

	 * so they don't see EPERM on something they shouldn't know about.

	 */

	if (!INGLOBALZONE(curproc) &&

	    !zone_dataset_visible(dataset, &writable))

		return (ENOENT);

	if (INGLOBALZONE(curproc)) {

		/*

		 * If the fs is zoned, only root can access it from the

		 * global zone.

		 */

		if (secpolicy_zfs(cr) && zoned)

			return (EPERM);

	} else {

		/*

		 * If we are in a local zone, the 'zoned' property must be set.

		 */

		if (!zoned)

			return (EPERM);

		/* must be writable by this zone */

		if (!writable)

			return (EPERM);

	}

	return (0);

}

static int

zfs_dozonecheck(const char *dataset, cred_t *cr)

{

	uint64_t zoned;

	if (dsl_prop_get_integer(dataset, "zoned", &zoned, NULL))

		return (ENOENT);

	return (zfs_dozonecheck_impl(dataset, zoned, cr));

}

static int

zfs_dozonecheck_ds(const char *dataset, dsl_dataset_t *ds, cred_t *cr)

{

	uint64_t zoned;

	rw_enter(&ds->ds_dir->dd_pool->dp_config_rwlock, RW_READER);

	if (dsl_prop_get_ds(ds, "zoned", 8, 1, &zoned, NULL)) {

		rw_exit(&ds->ds_dir->dd_pool->dp_config_rwlock);

		return (ENOENT);

	}

	rw_exit(&ds->ds_dir->dd_pool->dp_config_rwlock);

	return (zfs_dozonecheck_impl(dataset, zoned, cr));

}

int

zfs_secpolicy_write_perms(const char *name, const char *perm, cred_t *cr)

{

	int error;

	error = zfs_dozonecheck(name, cr);

	if (error == 0) {

		error = secpolicy_zfs(cr);

		if (error)

			error = dsl_deleg_access(name, perm, cr);

	}

	return (error);

}

int

zfs_secpolicy_write_perms_ds(const char *name, dsl_dataset_t *ds,

    const char *perm, cred_t *cr)

{

	int error;

	error = zfs_dozonecheck_ds(name, ds, cr);

	if (error == 0) {

		error = secpolicy_zfs(cr);

		if (error)

			error = dsl_deleg_access_impl(ds, perm, cr);

	}

	return (error);

}

/*

 * Policy for setting the security label property.

 *

 * Returns 0 for success, non-zero for access and other errors.

 */

static int

zfs_set_slabel_policy(const char *name, char *strval, cred_t *cr)

{

	char		ds_hexsl[MAXNAMELEN];

	bslabel_t	ds_sl, new_sl;

	boolean_t	new_default = FALSE;

	uint64_t	zoned;

	int		needed_priv = -1;

	int		error;

	/* First get the existing dataset label. */

	error = dsl_prop_get(name, zfs_prop_to_name(ZFS_PROP_MLSLABEL),

	    1, sizeof (ds_hexsl), &ds_hexsl, NULL);

	if (error)

		return (EPERM);

	if (strcasecmp(strval, ZFS_MLSLABEL_DEFAULT) == 0)

		new_default = TRUE;

	/* The label must be translatable */

	if (!new_default && (hexstr_to_label(strval, &new_sl) != 0))

		return (EINVAL);

	/*

	 * In a non-global zone, disallow attempts to set a label that

	 * doesn't match that of the zone; otherwise no other checks

	 * are needed.

	 */

	if (!INGLOBALZONE(curproc)) {

		if (new_default || !blequal(&new_sl, CR_SL(CRED())))

			return (EPERM);

		return (0);

	}

	/*

	 * For global-zone datasets (i.e., those whose zoned property is

	 * "off", verify that the specified new label is valid for the

	 * global zone.

	 */

	if (dsl_prop_get_integer(name,

	    zfs_prop_to_name(ZFS_PROP_ZONED), &zoned, NULL))

		return (EPERM);

	if (!zoned) {

		if (zfs_check_global_label(name, strval) != 0)

			return (EPERM);

	}

	/*

	 * If the existing dataset label is nondefault, check if the

	 * dataset is mounted (label cannot be changed while mounted).

	 * Get the zfsvfs; if there isn't one, then the dataset isn't

	 * mounted (or isn't a dataset, doesn't exist, ...).

	 */

	if (strcasecmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) != 0) {

		objset_t *os;

		static char *setsl_tag = "setsl_tag";

		/*

		 * Try to own the dataset; abort if there is any error,

		 * (e.g., already mounted, in use, or other error).

		 */

		error = dmu_objset_own(name, DMU_OST_ZFS, B_TRUE,

		    setsl_tag, &os);

		if (error)

			return (EPERM);

		dmu_objset_disown(os, setsl_tag);

		if (new_default) {

			needed_priv = PRIV_FILE_DOWNGRADE_SL;

			goto out_check;

		}

		if (hexstr_to_label(strval, &new_sl) != 0)

			return (EPERM);

		if (blstrictdom(&ds_sl, &new_sl))

			needed_priv = PRIV_FILE_DOWNGRADE_SL;

		else if (blstrictdom(&new_sl, &ds_sl))

			needed_priv = PRIV_FILE_UPGRADE_SL;

	} else {

		/* dataset currently has a default label */

		if (!new_default)

			needed_priv = PRIV_FILE_UPGRADE_SL;

	}

out_check:

	if (needed_priv != -1)

		return (PRIV_POLICY(cr, needed_priv, B_FALSE, EPERM, NULL));

	return (0);

}

static int

zfs_secpolicy_setprop(const char *dsname, zfs_prop_t prop, nvpair_t *propval,

    cred_t *cr)

{

	char *strval;

	/*

	 * Check permissions for special properties.

	 */

	switch (prop) {

	case ZFS_PROP_ZONED:

		/*

		 * Disallow setting of 'zoned' from within a local zone.

		 */

		if (!INGLOBALZONE(curproc))

			return (EPERM);

		break;