acl_common.c revision a3c49ce110f325a563c245bedc4d533adddb7211
fa9e4066f08beec538e775443c5be79dd423fcabahrens/*
fa9e4066f08beec538e775443c5be79dd423fcabahrens * CDDL HEADER START
fa9e4066f08beec538e775443c5be79dd423fcabahrens *
fa9e4066f08beec538e775443c5be79dd423fcabahrens * The contents of this file are subject to the terms of the
f48205be61a214698b763ff550ab9e657525104ccasper * Common Development and Distribution License (the "License").
f48205be61a214698b763ff550ab9e657525104ccasper * You may not use this file except in compliance with the License.
fa9e4066f08beec538e775443c5be79dd423fcabahrens *
fa9e4066f08beec538e775443c5be79dd423fcabahrens * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
fa9e4066f08beec538e775443c5be79dd423fcabahrens * or http://www.opensolaris.org/os/licensing.
fa9e4066f08beec538e775443c5be79dd423fcabahrens * See the License for the specific language governing permissions
fa9e4066f08beec538e775443c5be79dd423fcabahrens * and limitations under the License.
fa9e4066f08beec538e775443c5be79dd423fcabahrens *
fa9e4066f08beec538e775443c5be79dd423fcabahrens * When distributing Covered Code, include this CDDL HEADER in each
fa9e4066f08beec538e775443c5be79dd423fcabahrens * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
fa9e4066f08beec538e775443c5be79dd423fcabahrens * If applicable, add the following below this CDDL HEADER, with the
fa9e4066f08beec538e775443c5be79dd423fcabahrens * fields enclosed by brackets "[]" replaced with your own identifying
fa9e4066f08beec538e775443c5be79dd423fcabahrens * information: Portions Copyright [yyyy] [name of copyright owner]
fa9e4066f08beec538e775443c5be79dd423fcabahrens *
fa9e4066f08beec538e775443c5be79dd423fcabahrens * CDDL HEADER END
fa9e4066f08beec538e775443c5be79dd423fcabahrens */
fa9e4066f08beec538e775443c5be79dd423fcabahrens/*
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
fa9e4066f08beec538e775443c5be79dd423fcabahrens */
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens#include <sys/types.h>
fa9e4066f08beec538e775443c5be79dd423fcabahrens#include <sys/stat.h>
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#include <sys/avl.h>
fa9e4066f08beec538e775443c5be79dd423fcabahrens#if defined(_KERNEL)
fa9e4066f08beec538e775443c5be79dd423fcabahrens#include <sys/systm.h>
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#include <sys/sysmacros.h>
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#include <acl/acl_common.h>
fa9e4066f08beec538e775443c5be79dd423fcabahrens#else
fa9e4066f08beec538e775443c5be79dd423fcabahrens#include <errno.h>
fa9e4066f08beec538e775443c5be79dd423fcabahrens#include <stdlib.h>
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#include <stddef.h>
fa9e4066f08beec538e775443c5be79dd423fcabahrens#include <strings.h>
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#include <unistd.h>
fa9e4066f08beec538e775443c5be79dd423fcabahrens#include <assert.h>
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#include <grp.h>
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#include <pwd.h>
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#include <acl_common.h>
fa9e4066f08beec538e775443c5be79dd423fcabahrens#define ASSERT assert
fa9e4066f08beec538e775443c5be79dd423fcabahrens#endif
fa9e4066f08beec538e775443c5be79dd423fcabahrens
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACE_POSIX_SUPPORTED_BITS (ACE_READ_DATA | \
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_WRITE_DATA | ACE_APPEND_DATA | ACE_EXECUTE | \
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_READ_ATTRIBUTES | ACE_READ_ACL | ACE_WRITE_ACL)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_SYNCHRONIZE_SET_DENY 0x0000001
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_SYNCHRONIZE_SET_ALLOW 0x0000002
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_SYNCHRONIZE_ERR_DENY 0x0000004
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_SYNCHRONIZE_ERR_ALLOW 0x0000008
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_WRITE_OWNER_SET_DENY 0x0000010
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_WRITE_OWNER_SET_ALLOW 0x0000020
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_WRITE_OWNER_ERR_DENY 0x0000040
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_WRITE_OWNER_ERR_ALLOW 0x0000080
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_DELETE_SET_DENY 0x0000100
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_DELETE_SET_ALLOW 0x0000200
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_DELETE_ERR_DENY 0x0000400
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_DELETE_ERR_ALLOW 0x0000800
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_WRITE_ATTRS_OWNER_SET_DENY 0x0001000
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_WRITE_ATTRS_OWNER_SET_ALLOW 0x0002000
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_WRITE_ATTRS_OWNER_ERR_DENY 0x0004000
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_WRITE_ATTRS_OWNER_ERR_ALLOW 0x0008000
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_WRITE_ATTRS_WRITER_SET_DENY 0x0010000
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_WRITE_ATTRS_WRITER_SET_ALLOW 0x0020000
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_WRITE_ATTRS_WRITER_ERR_DENY 0x0040000
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_WRITE_ATTRS_WRITER_ERR_ALLOW 0x0080000
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_WRITE_NAMED_WRITER_SET_DENY 0x0100000
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_WRITE_NAMED_WRITER_SET_ALLOW 0x0200000
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_WRITE_NAMED_WRITER_ERR_DENY 0x0400000
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_WRITE_NAMED_WRITER_ERR_ALLOW 0x0800000
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_READ_NAMED_READER_SET_DENY 0x1000000
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_READ_NAMED_READER_SET_ALLOW 0x2000000
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_READ_NAMED_READER_ERR_DENY 0x4000000
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACL_READ_NAMED_READER_ERR_ALLOW 0x8000000
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACE_VALID_MASK_BITS (\
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_READ_DATA | \
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_LIST_DIRECTORY | \
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_WRITE_DATA | \
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_ADD_FILE | \
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_APPEND_DATA | \
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_ADD_SUBDIRECTORY | \
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_READ_NAMED_ATTRS | \
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_WRITE_NAMED_ATTRS | \
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_EXECUTE | \
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_DELETE_CHILD | \
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_READ_ATTRIBUTES | \
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_WRITE_ATTRIBUTES | \
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_DELETE | \
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_READ_ACL | \
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_WRITE_ACL | \
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_WRITE_OWNER | \
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_SYNCHRONIZE)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACE_MASK_UNDEFINED 0x80000000
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#define ACE_VALID_FLAG_BITS (ACE_FILE_INHERIT_ACE | \
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_DIRECTORY_INHERIT_ACE | \
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_NO_PROPAGATE_INHERIT_ACE | ACE_INHERIT_ONLY_ACE | \
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_SUCCESSFUL_ACCESS_ACE_FLAG | ACE_FAILED_ACCESS_ACE_FLAG | \
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_IDENTIFIER_GROUP | ACE_OWNER | ACE_GROUP | ACE_EVERYONE)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw/*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * ACL conversion helpers
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwtypedef enum {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ace_unused,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ace_user_obj,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ace_user,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ace_group, /* includes GROUP and GROUP_OBJ */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ace_other_obj
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw} ace_to_aent_state_t;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwtypedef struct acevals {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw uid_t key;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw avl_node_t avl;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw uint32_t mask;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw uint32_t allowed;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw uint32_t denied;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int aent_type;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw} acevals_t;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwtypedef struct ace_list {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acevals_t user_obj;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw avl_tree_t user;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int numusers;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acevals_t group_obj;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw avl_tree_t group;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int numgroups;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acevals_t other_obj;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw uint32_t acl_mask;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int hasmask;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int dfacl_flag;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ace_to_aent_state_t state;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int seen; /* bitmask of all aclent_t a_type values seen */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw} ace_list_t;
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens/*
fa9e4066f08beec538e775443c5be79dd423fcabahrens * Generic shellsort, from K&R (1st ed, p 58.), somewhat modified.
fa9e4066f08beec538e775443c5be79dd423fcabahrens * v = Ptr to array/vector of objs
fa9e4066f08beec538e775443c5be79dd423fcabahrens * n = # objs in the array
fa9e4066f08beec538e775443c5be79dd423fcabahrens * s = size of each obj (must be multiples of a word size)
fa9e4066f08beec538e775443c5be79dd423fcabahrens * f = ptr to function to compare two objs
fa9e4066f08beec538e775443c5be79dd423fcabahrens * returns (-1 = less than, 0 = equal, 1 = greater than
fa9e4066f08beec538e775443c5be79dd423fcabahrens */
fa9e4066f08beec538e775443c5be79dd423fcabahrensvoid
fa9e4066f08beec538e775443c5be79dd423fcabahrensksort(caddr_t v, int n, int s, int (*f)())
fa9e4066f08beec538e775443c5be79dd423fcabahrens{
fa9e4066f08beec538e775443c5be79dd423fcabahrens int g, i, j, ii;
fa9e4066f08beec538e775443c5be79dd423fcabahrens unsigned int *p1, *p2;
fa9e4066f08beec538e775443c5be79dd423fcabahrens unsigned int tmp;
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens /* No work to do */
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (v == NULL || n <= 1)
fa9e4066f08beec538e775443c5be79dd423fcabahrens return;
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens /* Sanity check on arguments */
fa9e4066f08beec538e775443c5be79dd423fcabahrens ASSERT(((uintptr_t)v & 0x3) == 0 && (s & 0x3) == 0);
fa9e4066f08beec538e775443c5be79dd423fcabahrens ASSERT(s > 0);
fa9e4066f08beec538e775443c5be79dd423fcabahrens for (g = n / 2; g > 0; g /= 2) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens for (i = g; i < n; i++) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens for (j = i - g; j >= 0 &&
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (*f)(v + j * s, v + (j + g) * s) == 1;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw j -= g) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens p1 = (void *)(v + j * s);
fa9e4066f08beec538e775443c5be79dd423fcabahrens p2 = (void *)(v + (j + g) * s);
fa9e4066f08beec538e775443c5be79dd423fcabahrens for (ii = 0; ii < s / 4; ii++) {
fa9e4066f08beec538e775443c5be79dd423fcabahrens tmp = *p1;
fa9e4066f08beec538e775443c5be79dd423fcabahrens *p1++ = *p2;
fa9e4066f08beec538e775443c5be79dd423fcabahrens *p2++ = tmp;
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens }
fa9e4066f08beec538e775443c5be79dd423fcabahrens}
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens/*
fa9e4066f08beec538e775443c5be79dd423fcabahrens * Compare two acls, all fields. Returns:
fa9e4066f08beec538e775443c5be79dd423fcabahrens * -1 (less than)
fa9e4066f08beec538e775443c5be79dd423fcabahrens * 0 (equal)
fa9e4066f08beec538e775443c5be79dd423fcabahrens * +1 (greater than)
fa9e4066f08beec538e775443c5be79dd423fcabahrens */
fa9e4066f08beec538e775443c5be79dd423fcabahrensint
fa9e4066f08beec538e775443c5be79dd423fcabahrenscmp2acls(void *a, void *b)
fa9e4066f08beec538e775443c5be79dd423fcabahrens{
fa9e4066f08beec538e775443c5be79dd423fcabahrens aclent_t *x = (aclent_t *)a;
fa9e4066f08beec538e775443c5be79dd423fcabahrens aclent_t *y = (aclent_t *)b;
fa9e4066f08beec538e775443c5be79dd423fcabahrens
fa9e4066f08beec538e775443c5be79dd423fcabahrens /* Compare types */
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (x->a_type < y->a_type)
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (-1);
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (x->a_type > y->a_type)
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (1);
fa9e4066f08beec538e775443c5be79dd423fcabahrens /* Equal types; compare id's */
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (x->a_id < y->a_id)
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (-1);
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (x->a_id > y->a_id)
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (1);
fa9e4066f08beec538e775443c5be79dd423fcabahrens /* Equal ids; compare perms */
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (x->a_perm < y->a_perm)
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (-1);
fa9e4066f08beec538e775443c5be79dd423fcabahrens if (x->a_perm > y->a_perm)
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (1);
fa9e4066f08beec538e775443c5be79dd423fcabahrens /* Totally equal */
fa9e4066f08beec538e775443c5be79dd423fcabahrens return (0);
fa9e4066f08beec538e775443c5be79dd423fcabahrens}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw/*ARGSUSED*/
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwstatic void *
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwcacl_realloc(void *ptr, size_t size, size_t new_size)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#if defined(_KERNEL)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw void *tmp;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw tmp = kmem_alloc(new_size, KM_SLEEP);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (void) memcpy(tmp, ptr, (size < new_size) ? size : new_size);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw kmem_free(ptr, size);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (tmp);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#else
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (realloc(ptr, new_size));
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#endif
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwstatic int
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwcacl_malloc(void **ptr, size_t size)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#if defined(_KERNEL)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *ptr = kmem_zalloc(size, KM_SLEEP);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (0);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#else
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *ptr = calloc(1, size);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (*ptr == NULL)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (errno);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (0);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#endif
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw/*ARGSUSED*/
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwstatic void
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwcacl_free(void *ptr, size_t size)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#if defined(_KERNEL)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw kmem_free(ptr, size);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#else
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw free(ptr);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#endif
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwacl_t *
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwacl_alloc(enum acl_type type)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acl_t *aclp;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (cacl_malloc((void **)&aclp, sizeof (acl_t)) != 0)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (NULL);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aclp->acl_aclp = NULL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aclp->acl_cnt = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw switch (type) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw case ACE_T:
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aclp->acl_type = ACE_T;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aclp->acl_entry_size = sizeof (ace_t);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw break;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw case ACLENT_T:
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aclp->acl_type = ACLENT_T;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aclp->acl_entry_size = sizeof (aclent_t);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw break;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw default:
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acl_free(aclp);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aclp = NULL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (aclp);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw/*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * Free acl_t structure
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwvoid
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwacl_free(acl_t *aclp)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int acl_size;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (aclp == NULL)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (aclp->acl_aclp) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acl_size = aclp->acl_cnt * aclp->acl_entry_size;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw cacl_free(aclp->acl_aclp, acl_size);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw cacl_free(aclp, sizeof (acl_t));
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwstatic uint32_t
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwaccess_mask_set(int haswriteperm, int hasreadperm, int isowner, int isallow)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw uint32_t access_mask = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int acl_produce;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int synchronize_set = 0, write_owner_set = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int delete_set = 0, write_attrs_set = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int read_named_set = 0, write_named_set = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acl_produce = (ACL_SYNCHRONIZE_SET_ALLOW |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACL_WRITE_ATTRS_OWNER_SET_ALLOW |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACL_WRITE_ATTRS_WRITER_SET_DENY);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (isallow) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw synchronize_set = ACL_SYNCHRONIZE_SET_ALLOW;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw write_owner_set = ACL_WRITE_OWNER_SET_ALLOW;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw delete_set = ACL_DELETE_SET_ALLOW;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (hasreadperm)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw read_named_set = ACL_READ_NAMED_READER_SET_ALLOW;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (haswriteperm)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw write_named_set = ACL_WRITE_NAMED_WRITER_SET_ALLOW;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (isowner)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw write_attrs_set = ACL_WRITE_ATTRS_OWNER_SET_ALLOW;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw else if (haswriteperm)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw write_attrs_set = ACL_WRITE_ATTRS_WRITER_SET_ALLOW;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw synchronize_set = ACL_SYNCHRONIZE_SET_DENY;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw write_owner_set = ACL_WRITE_OWNER_SET_DENY;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw delete_set = ACL_DELETE_SET_DENY;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (hasreadperm)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw read_named_set = ACL_READ_NAMED_READER_SET_DENY;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (haswriteperm)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw write_named_set = ACL_WRITE_NAMED_WRITER_SET_DENY;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (isowner)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw write_attrs_set = ACL_WRITE_ATTRS_OWNER_SET_DENY;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw else if (haswriteperm)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw write_attrs_set = ACL_WRITE_ATTRS_WRITER_SET_DENY;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw else
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * If the entity is not the owner and does not
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * have write permissions ACE_WRITE_ATTRIBUTES will
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * always go in the DENY ACE.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw access_mask |= ACE_WRITE_ATTRIBUTES;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (acl_produce & synchronize_set)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw access_mask |= ACE_SYNCHRONIZE;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (acl_produce & write_owner_set)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw access_mask |= ACE_WRITE_OWNER;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (acl_produce & delete_set)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw access_mask |= ACE_DELETE;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (acl_produce & write_attrs_set)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw access_mask |= ACE_WRITE_ATTRIBUTES;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (acl_produce & read_named_set)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw access_mask |= ACE_READ_NAMED_ATTRS;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (acl_produce & write_named_set)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw access_mask |= ACE_WRITE_NAMED_ATTRS;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (access_mask);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw/*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * Given an mode_t, convert it into an access_mask as used
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * by nfsace, assuming aclent_t -> nfsace semantics.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwstatic uint32_t
a3c49ce110f325a563c245bedc4d533adddb7211Albert Leemode_to_ace_access(mode_t mode, boolean_t isdir, int isowner, int isallow)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw uint32_t access = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int haswriteperm = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int hasreadperm = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (isallow) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw haswriteperm = (mode & S_IWOTH);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw hasreadperm = (mode & S_IROTH);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw haswriteperm = !(mode & S_IWOTH);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw hasreadperm = !(mode & S_IROTH);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * The following call takes care of correctly setting the following
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * mask bits in the access_mask:
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * ACE_SYNCHRONIZE, ACE_WRITE_OWNER, ACE_DELETE,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * ACE_WRITE_ATTRIBUTES, ACE_WRITE_NAMED_ATTRS, ACE_READ_NAMED_ATTRS
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw access = access_mask_set(haswriteperm, hasreadperm, isowner, isallow);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (isallow) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw access |= ACE_READ_ACL | ACE_READ_ATTRIBUTES;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (isowner)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw access |= ACE_WRITE_ACL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (! isowner)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw access |= ACE_WRITE_ACL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* read */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (mode & S_IROTH) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw access |= ACE_READ_DATA;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* write */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (mode & S_IWOTH) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw access |= ACE_WRITE_DATA |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_APPEND_DATA;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (isdir)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw access |= ACE_DELETE_CHILD;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* exec */
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee if (mode & S_IXOTH) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw access |= ACE_EXECUTE;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (access);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw/*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * Given an nfsace (presumably an ALLOW entry), make a
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * corresponding DENY entry at the address given.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwstatic void
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwace_make_deny(ace_t *allow, ace_t *deny, int isdir, int isowner)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (void) memcpy(deny, allow, sizeof (ace_t));
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw deny->a_who = allow->a_who;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw deny->a_type = ACE_ACCESS_DENIED_ACE_TYPE;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw deny->a_access_mask ^= ACE_POSIX_SUPPORTED_BITS;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (isdir)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw deny->a_access_mask ^= ACE_DELETE_CHILD;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw deny->a_access_mask &= ~(ACE_SYNCHRONIZE | ACE_WRITE_OWNER |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_DELETE | ACE_WRITE_ATTRIBUTES | ACE_READ_NAMED_ATTRS |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_WRITE_NAMED_ATTRS);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw deny->a_access_mask |= access_mask_set((allow->a_access_mask &
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_WRITE_DATA), (allow->a_access_mask & ACE_READ_DATA), isowner,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw B_FALSE);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw/*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * Make an initial pass over an array of aclent_t's. Gather
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * information such as an ACL_MASK (if any), number of users,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * number of groups, and whether the array needs to be sorted.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwstatic int
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwln_aent_preprocess(aclent_t *aclent, int n,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int *hasmask, mode_t *mask,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int *numuser, int *numgroup, int *needsort)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int error = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int i;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int curtype = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *hasmask = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *mask = 07;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *needsort = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *numuser = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *numgroup = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw for (i = 0; i < n; i++) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (aclent[i].a_type < curtype)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *needsort = 1;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw else if (aclent[i].a_type > curtype)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw curtype = aclent[i].a_type;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (aclent[i].a_type & USER)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (*numuser)++;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (aclent[i].a_type & (GROUP | GROUP_OBJ))
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (*numgroup)++;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (aclent[i].a_type & CLASS_OBJ) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (*hasmask) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = EINVAL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *hasmask = 1;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *mask = aclent[i].a_perm;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if ((! *hasmask) && (*numuser + *numgroup > 1)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = EINVAL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwout:
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (error);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw/*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * Convert an array of aclent_t into an array of nfsace entries,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * following POSIX draft -> nfsv4 conversion semantics as outlined in
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * the IETF draft.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwstatic int
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwln_aent_to_ace(aclent_t *aclent, int n, ace_t **acepp, int *rescount, int isdir)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int error = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw mode_t mask;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int numuser, numgroup, needsort;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int resultsize = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int i, groupi = 0, skip;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ace_t *acep, *result = NULL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int hasmask;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ln_aent_preprocess(aclent, n, &hasmask, &mask,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw &numuser, &numgroup, &needsort);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error != 0)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* allow + deny for each aclent */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw resultsize = n * 2;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (hasmask) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * stick extra deny on the group_obj and on each
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * user|group for the mask (the group_obj was added
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * into the count for numgroup)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw resultsize += numuser + numgroup;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* ... and don't count the mask itself */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw resultsize -= 2;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* sort the source if necessary */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (needsort)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ksort((caddr_t)aclent, n, sizeof (aclent_t), cmp2acls);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (cacl_malloc((void **)&result, resultsize * sizeof (ace_t)) != 0)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep = result;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw for (i = 0; i < n; i++) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * don't process CLASS_OBJ (mask); mask was grabbed in
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * ln_aent_preprocess()
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (aclent[i].a_type & CLASS_OBJ)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw continue;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* If we need an ACL_MASK emulator, prepend it now */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if ((hasmask) &&
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (aclent[i].a_type & (USER | GROUP | GROUP_OBJ))) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep->a_type = ACE_ACCESS_DENIED_ACE_TYPE;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep->a_flags = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (aclent[i].a_type & GROUP_OBJ) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep->a_who = (uid_t)-1;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep->a_flags |=
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (ACE_IDENTIFIER_GROUP|ACE_GROUP);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else if (aclent[i].a_type & USER) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep->a_who = aclent[i].a_id;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep->a_who = aclent[i].a_id;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep->a_flags |= ACE_IDENTIFIER_GROUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (aclent[i].a_type & ACL_DEFAULT) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep->a_flags |= ACE_INHERIT_ONLY_ACE |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_FILE_INHERIT_ACE |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_DIRECTORY_INHERIT_ACE;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * Set the access mask for the prepended deny
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * ace. To do this, we invert the mask (found
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * in ln_aent_preprocess()) then convert it to an
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * DENY ace access_mask.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep->a_access_mask = mode_to_ace_access((mask ^ 07),
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw isdir, 0, 0);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep += 1;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* handle a_perm -> access_mask */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep->a_access_mask = mode_to_ace_access(aclent[i].a_perm,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw isdir, aclent[i].a_type & USER_OBJ, 1);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* emulate a default aclent */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (aclent[i].a_type & ACL_DEFAULT) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep->a_flags |= ACE_INHERIT_ONLY_ACE |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_FILE_INHERIT_ACE |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_DIRECTORY_INHERIT_ACE;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * handle a_perm and a_id
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * this must be done last, since it involves the
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * corresponding deny aces, which are handled
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * differently for each different a_type.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (aclent[i].a_type & USER_OBJ) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep->a_who = (uid_t)-1;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep->a_flags |= ACE_OWNER;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ace_make_deny(acep, acep + 1, isdir, B_TRUE);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep += 2;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else if (aclent[i].a_type & USER) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep->a_who = aclent[i].a_id;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ace_make_deny(acep, acep + 1, isdir, B_FALSE);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep += 2;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else if (aclent[i].a_type & (GROUP_OBJ | GROUP)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (aclent[i].a_type & GROUP_OBJ) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep->a_who = (uid_t)-1;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep->a_flags |= ACE_GROUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep->a_who = aclent[i].a_id;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep->a_flags |= ACE_IDENTIFIER_GROUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * Set the corresponding deny for the group ace.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * The deny aces go after all of the groups, unlike
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * everything else, where they immediately follow
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * the allow ace.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * We calculate "skip", the number of slots to
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * skip ahead for the deny ace, here.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * The pattern is:
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * MD1 A1 MD2 A2 MD3 A3 D1 D2 D3
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * thus, skip is
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * (2 * numgroup) - 1 - groupi
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * (2 * numgroup) to account for MD + A
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * - 1 to account for the fact that we're on the
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * access (A), not the mask (MD)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * - groupi to account for the fact that we have
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * passed up groupi number of MD's.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw skip = (2 * numgroup) - 1 - groupi;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ace_make_deny(acep, acep + skip, isdir, B_FALSE);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * If we just did the last group, skip acep past
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * all of the denies; else, just move ahead one.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (++groupi >= numgroup)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep += numgroup + 1;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw else
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep += 1;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else if (aclent[i].a_type & OTHER_OBJ) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep->a_who = (uid_t)-1;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep->a_flags |= ACE_EVERYONE;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ace_make_deny(acep, acep + 1, isdir, B_FALSE);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep += 2;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = EINVAL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *acepp = result;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *rescount = resultsize;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwout:
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error != 0) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if ((result != NULL) && (resultsize > 0)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw cacl_free(result, resultsize * sizeof (ace_t));
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (error);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwstatic int
a3c49ce110f325a563c245bedc4d533adddb7211Albert Leeconvert_aent_to_ace(aclent_t *aclentp, int aclcnt, boolean_t isdir,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ace_t **retacep, int *retacecnt)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ace_t *acep;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ace_t *dfacep;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int acecnt = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int dfacecnt = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int dfaclstart = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int dfaclcnt = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aclent_t *aclp;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int i;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int error;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int acesz, dfacesz;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ksort((caddr_t)aclentp, aclcnt, sizeof (aclent_t), cmp2acls);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw for (i = 0, aclp = aclentp; i < aclcnt; aclp++, i++) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (aclp->a_type & ACL_DEFAULT)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw break;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (i < aclcnt) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw dfaclstart = i;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw dfaclcnt = aclcnt - i;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee if (dfaclcnt && !isdir) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (EINVAL);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ln_aent_to_ace(aclentp, i, &acep, &acecnt, isdir);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (error);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (dfaclcnt) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ln_aent_to_ace(&aclentp[dfaclstart], dfaclcnt,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw &dfacep, &dfacecnt, isdir);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (acep) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw cacl_free(acep, acecnt * sizeof (ace_t));
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (error);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (dfacecnt != 0) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acesz = sizeof (ace_t) * acecnt;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw dfacesz = sizeof (ace_t) * dfacecnt;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep = cacl_realloc(acep, acesz, acesz + dfacesz);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (acep == NULL)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (ENOMEM);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (dfaclcnt) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (void) memcpy(acep + acecnt, dfacep, dfacesz);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (dfaclcnt)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw cacl_free(dfacep, dfacecnt * sizeof (ace_t));
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *retacecnt = acecnt + dfacecnt;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *retacep = acep;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (0);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwstatic int
a3c49ce110f325a563c245bedc4d533adddb7211Albert Leeace_mask_to_mode(uint32_t mask, o_mode_t *modep, boolean_t isdir)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int error = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw o_mode_t mode = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw uint32_t bits, wantbits;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* read */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (mask & ACE_READ_DATA)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw mode |= S_IROTH;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* write */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw wantbits = (ACE_WRITE_DATA | ACE_APPEND_DATA);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (isdir)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw wantbits |= ACE_DELETE_CHILD;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw bits = mask & wantbits;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (bits != 0) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (bits != wantbits) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOTSUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw mode |= S_IWOTH;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* exec */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (mask & ACE_EXECUTE) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw mode |= S_IXOTH;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *modep = mode;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwout:
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (error);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwstatic void
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwacevals_init(acevals_t *vals, uid_t key)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw bzero(vals, sizeof (*vals));
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw vals->allowed = ACE_MASK_UNDEFINED;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw vals->denied = ACE_MASK_UNDEFINED;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw vals->mask = ACE_MASK_UNDEFINED;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw vals->key = key;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwstatic void
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwace_list_init(ace_list_t *al, int dfacl_flag)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acevals_init(&al->user_obj, NULL);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acevals_init(&al->group_obj, NULL);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acevals_init(&al->other_obj, NULL);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw al->numusers = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw al->numgroups = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw al->acl_mask = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw al->hasmask = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw al->state = ace_unused;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw al->seen = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw al->dfacl_flag = dfacl_flag;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw/*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * Find or create an acevals holder for a given id and avl tree.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * Note that only one thread will ever touch these avl trees, so
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * there is no need for locking.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwstatic acevals_t *
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwacevals_find(ace_t *ace, avl_tree_t *avl, int *num)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acevals_t key, *rc;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw avl_index_t where;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw key.key = ace->a_who;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw rc = avl_find(avl, &key, &where);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (rc != NULL)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (rc);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* this memory is freed by ln_ace_to_aent()->ace_list_free() */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (cacl_malloc((void **)&rc, sizeof (acevals_t)) != 0)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (NULL);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acevals_init(rc, ace->a_who);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw avl_insert(avl, rc, where);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (*num)++;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (rc);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwstatic int
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwaccess_mask_check(ace_t *acep, int mask_bit, int isowner)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int set_deny, err_deny;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int set_allow, err_allow;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int acl_consume;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int haswriteperm, hasreadperm;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (acep->a_type == ACE_ACCESS_DENIED_ACE_TYPE) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw haswriteperm = (acep->a_access_mask & ACE_WRITE_DATA) ? 0 : 1;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw hasreadperm = (acep->a_access_mask & ACE_READ_DATA) ? 0 : 1;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw haswriteperm = (acep->a_access_mask & ACE_WRITE_DATA) ? 1 : 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw hasreadperm = (acep->a_access_mask & ACE_READ_DATA) ? 1 : 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acl_consume = (ACL_SYNCHRONIZE_ERR_DENY |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACL_DELETE_ERR_DENY |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACL_WRITE_OWNER_ERR_DENY |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACL_WRITE_OWNER_ERR_ALLOW |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACL_WRITE_ATTRS_OWNER_SET_ALLOW |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACL_WRITE_ATTRS_OWNER_ERR_DENY |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACL_WRITE_ATTRS_WRITER_SET_DENY |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACL_WRITE_ATTRS_WRITER_ERR_ALLOW |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACL_WRITE_NAMED_WRITER_ERR_DENY |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACL_READ_NAMED_READER_ERR_DENY);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (mask_bit == ACE_SYNCHRONIZE) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw set_deny = ACL_SYNCHRONIZE_SET_DENY;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw err_deny = ACL_SYNCHRONIZE_ERR_DENY;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw set_allow = ACL_SYNCHRONIZE_SET_ALLOW;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw err_allow = ACL_SYNCHRONIZE_ERR_ALLOW;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else if (mask_bit == ACE_WRITE_OWNER) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw set_deny = ACL_WRITE_OWNER_SET_DENY;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw err_deny = ACL_WRITE_OWNER_ERR_DENY;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw set_allow = ACL_WRITE_OWNER_SET_ALLOW;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw err_allow = ACL_WRITE_OWNER_ERR_ALLOW;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else if (mask_bit == ACE_DELETE) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw set_deny = ACL_DELETE_SET_DENY;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw err_deny = ACL_DELETE_ERR_DENY;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw set_allow = ACL_DELETE_SET_ALLOW;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw err_allow = ACL_DELETE_ERR_ALLOW;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else if (mask_bit == ACE_WRITE_ATTRIBUTES) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (isowner) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw set_deny = ACL_WRITE_ATTRS_OWNER_SET_DENY;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw err_deny = ACL_WRITE_ATTRS_OWNER_ERR_DENY;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw set_allow = ACL_WRITE_ATTRS_OWNER_SET_ALLOW;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw err_allow = ACL_WRITE_ATTRS_OWNER_ERR_ALLOW;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else if (haswriteperm) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw set_deny = ACL_WRITE_ATTRS_WRITER_SET_DENY;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw err_deny = ACL_WRITE_ATTRS_WRITER_ERR_DENY;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw set_allow = ACL_WRITE_ATTRS_WRITER_SET_ALLOW;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw err_allow = ACL_WRITE_ATTRS_WRITER_ERR_ALLOW;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if ((acep->a_access_mask & mask_bit) &&
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (acep->a_type & ACE_ACCESS_ALLOWED_ACE_TYPE)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (ENOTSUP);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (0);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else if (mask_bit == ACE_READ_NAMED_ATTRS) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (!hasreadperm)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (0);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw set_deny = ACL_READ_NAMED_READER_SET_DENY;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw err_deny = ACL_READ_NAMED_READER_ERR_DENY;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw set_allow = ACL_READ_NAMED_READER_SET_ALLOW;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw err_allow = ACL_READ_NAMED_READER_ERR_ALLOW;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else if (mask_bit == ACE_WRITE_NAMED_ATTRS) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (!haswriteperm)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (0);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw set_deny = ACL_WRITE_NAMED_WRITER_SET_DENY;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw err_deny = ACL_WRITE_NAMED_WRITER_ERR_DENY;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw set_allow = ACL_WRITE_NAMED_WRITER_SET_ALLOW;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw err_allow = ACL_WRITE_NAMED_WRITER_ERR_ALLOW;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (EINVAL);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (acep->a_type == ACE_ACCESS_DENIED_ACE_TYPE) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (acl_consume & set_deny) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (!(acep->a_access_mask & mask_bit)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (ENOTSUP);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else if (acl_consume & err_deny) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (acep->a_access_mask & mask_bit) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (ENOTSUP);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* ACE_ACCESS_ALLOWED_ACE_TYPE */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (acl_consume & set_allow) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (!(acep->a_access_mask & mask_bit)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (ENOTSUP);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else if (acl_consume & err_allow) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (acep->a_access_mask & mask_bit) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (ENOTSUP);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (0);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwstatic int
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwace_to_aent_legal(ace_t *acep)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int error = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int isowner;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* only ALLOW or DENY */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if ((acep->a_type != ACE_ACCESS_ALLOWED_ACE_TYPE) &&
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (acep->a_type != ACE_ACCESS_DENIED_ACE_TYPE)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOTSUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* check for invalid flags */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (acep->a_flags & ~(ACE_VALID_FLAG_BITS)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = EINVAL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* some flags are illegal */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (acep->a_flags & (ACE_SUCCESSFUL_ACCESS_ACE_FLAG |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_FAILED_ACCESS_ACE_FLAG |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_NO_PROPAGATE_INHERIT_ACE)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOTSUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* check for invalid masks */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (acep->a_access_mask & ~(ACE_VALID_MASK_BITS)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = EINVAL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if ((acep->a_flags & ACE_OWNER)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw isowner = 1;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw isowner = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = access_mask_check(acep, ACE_SYNCHRONIZE, isowner);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = access_mask_check(acep, ACE_WRITE_OWNER, isowner);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = access_mask_check(acep, ACE_DELETE, isowner);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = access_mask_check(acep, ACE_WRITE_ATTRIBUTES, isowner);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = access_mask_check(acep, ACE_READ_NAMED_ATTRS, isowner);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = access_mask_check(acep, ACE_WRITE_NAMED_ATTRS, isowner);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* more detailed checking of masks */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (acep->a_type == ACE_ACCESS_ALLOWED_ACE_TYPE) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (! (acep->a_access_mask & ACE_READ_ATTRIBUTES)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOTSUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if ((acep->a_access_mask & ACE_WRITE_DATA) &&
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (! (acep->a_access_mask & ACE_APPEND_DATA))) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOTSUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if ((! (acep->a_access_mask & ACE_WRITE_DATA)) &&
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (acep->a_access_mask & ACE_APPEND_DATA)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOTSUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* ACL enforcement */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if ((acep->a_access_mask & ACE_READ_ACL) &&
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (acep->a_type != ACE_ACCESS_ALLOWED_ACE_TYPE)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOTSUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (acep->a_access_mask & ACE_WRITE_ACL) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if ((acep->a_type == ACE_ACCESS_DENIED_ACE_TYPE) &&
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (isowner)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOTSUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if ((acep->a_type == ACE_ACCESS_ALLOWED_ACE_TYPE) &&
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (! isowner)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOTSUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwout:
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (error);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwstatic int
a3c49ce110f325a563c245bedc4d533adddb7211Albert Leeace_allow_to_mode(uint32_t mask, o_mode_t *modep, boolean_t isdir)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* ACE_READ_ACL and ACE_READ_ATTRIBUTES must both be set */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if ((mask & (ACE_READ_ACL | ACE_READ_ATTRIBUTES)) !=
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (ACE_READ_ACL | ACE_READ_ATTRIBUTES)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (ENOTSUP);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (ace_mask_to_mode(mask, modep, isdir));
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwstatic int
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwacevals_to_aent(acevals_t *vals, aclent_t *dest, ace_list_t *list,
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee uid_t owner, gid_t group, boolean_t isdir)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int error;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw uint32_t flips = ACE_POSIX_SUPPORTED_BITS;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (isdir)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw flips |= ACE_DELETE_CHILD;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (vals->allowed != (vals->denied ^ flips)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOTSUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if ((list->hasmask) && (list->acl_mask != vals->mask) &&
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (vals->aent_type & (USER | GROUP | GROUP_OBJ))) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOTSUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ace_allow_to_mode(vals->allowed, &dest->a_perm, isdir);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error != 0)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw dest->a_type = vals->aent_type;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (dest->a_type & (USER | GROUP)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw dest->a_id = vals->key;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else if (dest->a_type & USER_OBJ) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw dest->a_id = owner;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else if (dest->a_type & GROUP_OBJ) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw dest->a_id = group;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else if (dest->a_type & OTHER_OBJ) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw dest->a_id = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = EINVAL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwout:
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (error);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwstatic int
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwace_list_to_aent(ace_list_t *list, aclent_t **aclentp, int *aclcnt,
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee uid_t owner, gid_t group, boolean_t isdir)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int error = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aclent_t *aent, *result = NULL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acevals_t *vals;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int resultcount;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if ((list->seen & (USER_OBJ | GROUP_OBJ | OTHER_OBJ)) !=
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (USER_OBJ | GROUP_OBJ | OTHER_OBJ)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOTSUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if ((! list->hasmask) && (list->numusers + list->numgroups > 0)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOTSUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw resultcount = 3 + list->numusers + list->numgroups;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * This must be the same condition as below, when we add the CLASS_OBJ
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * (aka ACL mask)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if ((list->hasmask) || (! list->dfacl_flag))
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw resultcount += 1;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (cacl_malloc((void **)&result,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw resultcount * sizeof (aclent_t)) != 0) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOMEM;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aent = result;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* USER_OBJ */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (!(list->user_obj.aent_type & USER_OBJ)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = EINVAL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = acevals_to_aent(&list->user_obj, aent, list, owner, group,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw isdir);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error != 0)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ++aent;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* USER */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw vals = NULL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw for (vals = avl_first(&list->user); vals != NULL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw vals = AVL_NEXT(&list->user, vals)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (!(vals->aent_type & USER)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = EINVAL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = acevals_to_aent(vals, aent, list, owner, group,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw isdir);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error != 0)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ++aent;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* GROUP_OBJ */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (!(list->group_obj.aent_type & GROUP_OBJ)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = EINVAL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = acevals_to_aent(&list->group_obj, aent, list, owner, group,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw isdir);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error != 0)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ++aent;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* GROUP */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw vals = NULL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw for (vals = avl_first(&list->group); vals != NULL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw vals = AVL_NEXT(&list->group, vals)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (!(vals->aent_type & GROUP)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = EINVAL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = acevals_to_aent(vals, aent, list, owner, group,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw isdir);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error != 0)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ++aent;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * CLASS_OBJ (aka ACL_MASK)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * An ACL_MASK is not fabricated if the ACL is a default ACL.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * This is to follow UFS's behavior.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if ((list->hasmask) || (! list->dfacl_flag)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (list->hasmask) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw uint32_t flips = ACE_POSIX_SUPPORTED_BITS;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (isdir)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw flips |= ACE_DELETE_CHILD;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ace_mask_to_mode(list->acl_mask ^ flips,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw &aent->a_perm, isdir);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error != 0)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* fabricate the ACL_MASK from the group permissions */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ace_mask_to_mode(list->group_obj.allowed,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw &aent->a_perm, isdir);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error != 0)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aent->a_id = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aent->a_type = CLASS_OBJ | list->dfacl_flag;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ++aent;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* OTHER_OBJ */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (!(list->other_obj.aent_type & OTHER_OBJ)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = EINVAL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = acevals_to_aent(&list->other_obj, aent, list, owner, group,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw isdir);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error != 0)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ++aent;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *aclentp = result;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *aclcnt = resultcount;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwout:
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error != 0) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (result != NULL)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw cacl_free(result, resultcount * sizeof (aclent_t));
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (error);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw/*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * free all data associated with an ace_list
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwstatic void
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwace_list_free(ace_list_t *al)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acevals_t *node;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw void *cookie;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (al == NULL)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw cookie = NULL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw while ((node = avl_destroy_nodes(&al->user, &cookie)) != NULL)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw cacl_free(node, sizeof (acevals_t));
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw cookie = NULL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw while ((node = avl_destroy_nodes(&al->group, &cookie)) != NULL)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw cacl_free(node, sizeof (acevals_t));
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw avl_destroy(&al->user);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw avl_destroy(&al->group);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* free the container itself */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw cacl_free(al, sizeof (ace_list_t));
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwstatic int
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwacevals_compare(const void *va, const void *vb)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw const acevals_t *a = va, *b = vb;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (a->key == b->key)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (0);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (a->key > b->key)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (1);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw else
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (-1);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw/*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * Convert a list of ace_t entries to equivalent regular and default
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * aclent_t lists. Return error (ENOTSUP) when conversion is not possible.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwstatic int
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwln_ace_to_aent(ace_t *ace, int n, uid_t owner, gid_t group,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aclent_t **aclentp, int *aclcnt, aclent_t **dfaclentp, int *dfaclcnt,
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee boolean_t isdir)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int error = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ace_t *acep;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw uint32_t bits;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int i;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ace_list_t *normacl = NULL, *dfacl = NULL, *acl;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acevals_t *vals;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *aclentp = NULL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *aclcnt = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *dfaclentp = NULL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *dfaclcnt = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* we need at least user_obj, group_obj, and other_obj */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (n < 6) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOTSUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (ace == NULL) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = EINVAL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = cacl_malloc((void **)&normacl, sizeof (ace_list_t));
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error != 0)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw avl_create(&normacl->user, acevals_compare, sizeof (acevals_t),
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw offsetof(acevals_t, avl));
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw avl_create(&normacl->group, acevals_compare, sizeof (acevals_t),
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw offsetof(acevals_t, avl));
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ace_list_init(normacl, 0);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = cacl_malloc((void **)&dfacl, sizeof (ace_list_t));
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error != 0)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw avl_create(&dfacl->user, acevals_compare, sizeof (acevals_t),
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw offsetof(acevals_t, avl));
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw avl_create(&dfacl->group, acevals_compare, sizeof (acevals_t),
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw offsetof(acevals_t, avl));
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ace_list_init(dfacl, ACL_DEFAULT);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* process every ace_t... */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw for (i = 0; i < n; i++) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep = &ace[i];
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* rule out certain cases quickly */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ace_to_aent_legal(acep);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error != 0)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * Turn off these bits in order to not have to worry about
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * them when doing the checks for compliments.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acep->a_access_mask &= ~(ACE_WRITE_OWNER | ACE_DELETE |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_SYNCHRONIZE | ACE_WRITE_ATTRIBUTES |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_READ_NAMED_ATTRS | ACE_WRITE_NAMED_ATTRS);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* see if this should be a regular or default acl */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw bits = acep->a_flags &
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (ACE_INHERIT_ONLY_ACE |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_FILE_INHERIT_ACE |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_DIRECTORY_INHERIT_ACE);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (bits != 0) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* all or nothing on these inherit bits */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (bits != (ACE_INHERIT_ONLY_ACE |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_FILE_INHERIT_ACE |
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ACE_DIRECTORY_INHERIT_ACE)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOTSUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acl = dfacl;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acl = normacl;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if ((acep->a_flags & ACE_OWNER)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (acl->state > ace_user_obj) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOTSUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acl->state = ace_user_obj;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acl->seen |= USER_OBJ;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw vals = &acl->user_obj;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw vals->aent_type = USER_OBJ | acl->dfacl_flag;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else if ((acep->a_flags & ACE_EVERYONE)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acl->state = ace_other_obj;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acl->seen |= OTHER_OBJ;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw vals = &acl->other_obj;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw vals->aent_type = OTHER_OBJ | acl->dfacl_flag;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else if (acep->a_flags & ACE_IDENTIFIER_GROUP) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (acl->state > ace_group) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOTSUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if ((acep->a_flags & ACE_GROUP)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acl->seen |= GROUP_OBJ;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw vals = &acl->group_obj;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw vals->aent_type = GROUP_OBJ | acl->dfacl_flag;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acl->seen |= GROUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw vals = acevals_find(acep, &acl->group,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw &acl->numgroups);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (vals == NULL) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOMEM;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw vals->aent_type = GROUP | acl->dfacl_flag;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acl->state = ace_group;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (acl->state > ace_user) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOTSUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acl->state = ace_user;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acl->seen |= USER;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw vals = acevals_find(acep, &acl->user,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw &acl->numusers);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (vals == NULL) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOMEM;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw vals->aent_type = USER | acl->dfacl_flag;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (!(acl->state > ace_unused)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = EINVAL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (acep->a_type == ACE_ACCESS_ALLOWED_ACE_TYPE) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* no more than one allowed per aclent_t */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (vals->allowed != ACE_MASK_UNDEFINED) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOTSUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw vals->allowed = acep->a_access_mask;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * it's a DENY; if there was a previous DENY, it
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * must have been an ACL_MASK.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (vals->denied != ACE_MASK_UNDEFINED) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* ACL_MASK is for USER and GROUP only */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if ((acl->state != ace_user) &&
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (acl->state != ace_group)) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOTSUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (! acl->hasmask) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acl->hasmask = 1;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw acl->acl_mask = vals->denied;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* check for mismatched ACL_MASK emulations */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else if (acl->acl_mask != vals->denied) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOTSUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw vals->mask = vals->denied;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw vals->denied = acep->a_access_mask;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /* done collating; produce the aclent_t lists */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (normacl->state != ace_unused) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ace_list_to_aent(normacl, aclentp, aclcnt,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw owner, group, isdir);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error != 0) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (dfacl->state != ace_unused) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ace_list_to_aent(dfacl, dfaclentp, dfaclcnt,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw owner, group, isdir);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error != 0) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwout:
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (normacl != NULL)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ace_list_free(normacl);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (dfacl != NULL)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw ace_list_free(dfacl);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (error);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwstatic int
a3c49ce110f325a563c245bedc4d533adddb7211Albert Leeconvert_ace_to_aent(ace_t *acebufp, int acecnt, boolean_t isdir,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw uid_t owner, gid_t group, aclent_t **retaclentp, int *retaclcnt)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int error = 0;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aclent_t *aclentp, *dfaclentp;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int aclcnt, dfaclcnt;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int aclsz, dfaclsz;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ln_ace_to_aent(acebufp, acecnt, owner, group,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw &aclentp, &aclcnt, &dfaclentp, &dfaclcnt, isdir);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (error);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (dfaclcnt != 0) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * Slap aclentp and dfaclentp into a single array.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aclsz = sizeof (aclent_t) * aclcnt;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw dfaclsz = sizeof (aclent_t) * dfaclcnt;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aclentp = cacl_realloc(aclentp, aclsz, aclsz + dfaclsz);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (aclentp != NULL) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (void) memcpy(aclentp + aclcnt, dfaclentp, dfaclsz);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOMEM;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (aclentp) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *retaclentp = aclentp;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw *retaclcnt = aclcnt + dfaclcnt;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (dfaclentp)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw cacl_free(dfaclentp, dfaclsz);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (error);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwint
a3c49ce110f325a563c245bedc4d533adddb7211Albert Leeacl_translate(acl_t *aclp, int target_flavor, boolean_t isdir, uid_t owner,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw gid_t group)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw{
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int aclcnt;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw void *acldata;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw int error;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * See if we need to translate
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if ((target_flavor == _ACL_ACE_ENABLED && aclp->acl_type == ACE_T) ||
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (target_flavor == _ACL_ACLENT_ENABLED &&
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aclp->acl_type == ACLENT_T))
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (0);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (target_flavor == -1) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = EINVAL;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (target_flavor == _ACL_ACE_ENABLED &&
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aclp->acl_type == ACLENT_T) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = convert_aent_to_ace(aclp->acl_aclp,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aclp->acl_cnt, isdir, (ace_t **)&acldata, &aclcnt);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else if (target_flavor == _ACL_ACLENT_ENABLED &&
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aclp->acl_type == ACE_T) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = convert_ace_to_aent(aclp->acl_aclp, aclp->acl_cnt,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw isdir, owner, group, (aclent_t **)&acldata, &aclcnt);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (error)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw error = ENOTSUP;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw goto out;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw /*
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * replace old acl with newly translated acl
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw */
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw cacl_free(aclp->acl_aclp, aclp->acl_cnt * aclp->acl_entry_size);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aclp->acl_aclp = acldata;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aclp->acl_cnt = aclcnt;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw if (target_flavor == _ACL_ACE_ENABLED) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aclp->acl_type = ACE_T;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aclp->acl_entry_size = sizeof (ace_t);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw } else {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aclp->acl_type = ACLENT_T;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw aclp->acl_entry_size = sizeof (aclent_t);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw }
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (0);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amwout:
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#if !defined(_KERNEL)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw errno = error;
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (-1);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#else
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (error);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw#endif
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw}
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum#define SET_ACE(acl, index, who, mask, type, flags) { \
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum acl[0][index].a_who = (uint32_t)who; \
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum acl[0][index].a_type = type; \
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum acl[0][index].a_flags = flags; \
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum acl[0][index++].a_access_mask = mask; \
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum}
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaumvoid
a3c49ce110f325a563c245bedc4d533adddb7211Albert Leeacl_trivial_access_masks(mode_t mode, boolean_t isdir, trivial_acl_t *masks)
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum{
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee uint32_t read_mask = ACE_READ_DATA;
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee uint32_t write_mask = ACE_WRITE_DATA|ACE_APPEND_DATA;
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee uint32_t execute_mask = ACE_EXECUTE;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee (void) isdir; /* will need this later */
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->deny1 = 0;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if (!(mode & S_IRUSR) && (mode & (S_IRGRP|S_IROTH)))
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->deny1 |= read_mask;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if (!(mode & S_IWUSR) && (mode & (S_IWGRP|S_IWOTH)))
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->deny1 |= write_mask;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if (!(mode & S_IXUSR) && (mode & (S_IXGRP|S_IXOTH)))
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->deny1 |= execute_mask;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->deny2 = 0;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if (!(mode & S_IRGRP) && (mode & S_IROTH))
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->deny2 |= read_mask;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if (!(mode & S_IWGRP) && (mode & S_IWOTH))
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->deny2 |= write_mask;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if (!(mode & S_IXGRP) && (mode & S_IXOTH))
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->deny2 |= execute_mask;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->allow0 = 0;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if ((mode & S_IRUSR) && (!(mode & S_IRGRP) && (mode & S_IROTH)))
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->allow0 |= read_mask;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if ((mode & S_IWUSR) && (!(mode & S_IWGRP) && (mode & S_IWOTH)))
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->allow0 |= write_mask;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if ((mode & S_IXUSR) && (!(mode & S_IXGRP) && (mode & S_IXOTH)))
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->allow0 |= execute_mask;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->owner = ACE_WRITE_ATTRIBUTES|ACE_WRITE_OWNER|ACE_WRITE_ACL|
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum ACE_WRITE_NAMED_ATTRS|ACE_READ_ACL|ACE_READ_ATTRIBUTES|
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum ACE_READ_NAMED_ATTRS|ACE_SYNCHRONIZE;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if (mode & S_IRUSR)
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->owner |= read_mask;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if (mode & S_IWUSR)
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->owner |= write_mask;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if (mode & S_IXUSR)
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->owner |= execute_mask;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->group = ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_READ_NAMED_ATTRS|
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum ACE_SYNCHRONIZE;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if (mode & S_IRGRP)
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->group |= read_mask;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if (mode & S_IWGRP)
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->group |= write_mask;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if (mode & S_IXGRP)
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->group |= execute_mask;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->everyone = ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_READ_NAMED_ATTRS|
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum ACE_SYNCHRONIZE;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if (mode & S_IROTH)
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->everyone |= read_mask;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if (mode & S_IWOTH)
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->everyone |= write_mask;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if (mode & S_IXOTH)
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee masks->everyone |= execute_mask;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum}
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaumint
a3c49ce110f325a563c245bedc4d533adddb7211Albert Leeacl_trivial_create(mode_t mode, boolean_t isdir, ace_t **acl, int *count)
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum{
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum int index = 0;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum int error;
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee trivial_acl_t masks;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum *count = 3;
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee acl_trivial_access_masks(mode, isdir, &masks);
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee if (masks.allow0)
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum (*count)++;
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee if (masks.deny1)
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum (*count)++;
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee if (masks.deny2)
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum (*count)++;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if ((error = cacl_malloc((void **)acl, *count * sizeof (ace_t))) != 0)
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum return (error);
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee if (masks.allow0) {
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee SET_ACE(acl, index, -1, masks.allow0,
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee ACE_ACCESS_ALLOWED_ACE_TYPE, ACE_OWNER);
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum }
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee if (masks.deny1) {
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee SET_ACE(acl, index, -1, masks.deny1,
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee ACE_ACCESS_DENIED_ACE_TYPE, ACE_OWNER);
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum }
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee if (masks.deny2) {
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee SET_ACE(acl, index, -1, masks.deny2,
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee ACE_ACCESS_DENIED_ACE_TYPE, ACE_GROUP|ACE_IDENTIFIER_GROUP);
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum }
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee SET_ACE(acl, index, -1, masks.owner, ACE_ACCESS_ALLOWED_ACE_TYPE,
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee ACE_OWNER);
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee SET_ACE(acl, index, -1, masks.group, ACE_ACCESS_ALLOWED_ACE_TYPE,
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum ACE_IDENTIFIER_GROUP|ACE_GROUP);
a3c49ce110f325a563c245bedc4d533adddb7211Albert Lee SET_ACE(acl, index, -1, masks.everyone, ACE_ACCESS_ALLOWED_ACE_TYPE,
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum ACE_EVERYONE);
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum return (0);
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum}
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum/*
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum * ace_trivial:
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum * determine whether an ace_t acl is trivial
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum *
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum * Trivialness implies that the acl is composed of only
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum * owner, group, everyone entries. ACL can't
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum * have read_acl denied, and write_owner/write_acl/write_attributes
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum * can only be owner@ entry.
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum */
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaumint
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaumace_trivial_common(void *acep, int aclcnt,
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum uint64_t (*walk)(void *, uint64_t, int aclcnt,
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum uint16_t *, uint16_t *, uint32_t *))
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum{
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum uint16_t flags;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum uint32_t mask;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum uint16_t type;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum uint64_t cookie = 0;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum while (cookie = walk(acep, cookie, aclcnt, &flags, &type, &mask)) {
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum switch (flags & ACE_TYPE_FLAGS) {
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum case ACE_OWNER:
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum case ACE_GROUP|ACE_IDENTIFIER_GROUP:
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum case ACE_EVERYONE:
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum break;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum default:
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum return (1);
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum }
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if (flags & (ACE_FILE_INHERIT_ACE|
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum ACE_DIRECTORY_INHERIT_ACE|ACE_NO_PROPAGATE_INHERIT_ACE|
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum ACE_INHERIT_ONLY_ACE))
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum return (1);
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum /*
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum * Special check for some special bits
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum *
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum * Don't allow anybody to deny reading basic
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum * attributes or a files ACL.
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum */
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if ((mask & (ACE_READ_ACL|ACE_READ_ATTRIBUTES)) &&
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum (type == ACE_ACCESS_DENIED_ACE_TYPE))
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum return (1);
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum /*
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum * Delete permissions are never set by default
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum */
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if (mask & (ACE_DELETE|ACE_DELETE_CHILD))
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum return (1);
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum /*
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum * only allow owner@ to have
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum * write_acl/write_owner/write_attributes/write_xattr/
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum */
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if (type == ACE_ACCESS_ALLOWED_ACE_TYPE &&
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum (!(flags & ACE_OWNER) && (mask &
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum (ACE_WRITE_OWNER|ACE_WRITE_ACL| ACE_WRITE_ATTRIBUTES|
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum ACE_WRITE_NAMED_ATTRS))))
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum return (1);
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum }
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum return (0);
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum}
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaumuint64_t
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaumace_walk(void *datap, uint64_t cookie, int aclcnt, uint16_t *flags,
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum uint16_t *type, uint32_t *mask)
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum{
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum ace_t *acep = datap;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum if (cookie >= aclcnt)
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum return (0);
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum *flags = acep[cookie].a_flags;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum *type = acep[cookie].a_type;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum *mask = acep[cookie++].a_access_mask;
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum return (cookie);
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum}
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaumint
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaumace_trivial(ace_t *acep, int aclcnt)
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum{
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum return (ace_trivial_common(acep, aclcnt, ace_walk));
27dd1e87cd3d939264769dd4af7e6a529cde001fMark Shellenbaum}