/* * Copyright (c) 2000-2015 Apple Inc. All rights reserved. * * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ * * This file contains Original Code and/or Modifications of Original Code * as defined in and that are subject to the Apple Public Source License * Version 2.0 (the 'License'). You may not use this file except in * compliance with the License. The rights granted to you under the License * may not be used to create, or enable the creation or redistribution of, * unlawful or unlicensed copies of an Apple operating system, or to * circumvent, violate, or enable the circumvention or violation of, any * terms of an Apple operating system software license agreement. * * Please obtain a copy of the License at * http://www.opensource.apple.com/apsl/ and read it before using this file. * * The Original Code and all software distributed under the License are * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. * Please see the License for the specific language governing rights and * limitations under the License. * * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ */ /* Copyright (c) 1995 NeXT Computer, Inc. All Rights Reserved */ /* * Copyright (c) 1982, 1986, 1989, 1993 * The Regents of the University of California. All rights reserved. * (c) UNIX System Laboratories, Inc. * All or some portions of this file are derived from material licensed * to the University of California by American Telephone and Telegraph * Co. or Unix System Laboratories, Inc. and are reproduced herein with * the permission of UNIX System Laboratories, Inc. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions * are met: * 1. Redistributions of source code must retain the above copyright * notice, this list of conditions and the following disclaimer. * 2. Redistributions in binary form must reproduce the above copyright * notice, this list of conditions and the following disclaimer in the * documentation and/or other materials provided with the distribution. * 3. All advertising materials mentioning features or use of this software * must display the following acknowledgement: * This product includes software developed by the University of * California, Berkeley and its contributors. * 4. Neither the name of the University nor the names of its contributors * may be used to endorse or promote products derived from this software * without specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF * SUCH DAMAGE. * * @(#)vfs_lookup.c 8.10 (Berkeley) 5/27/95 */ /* * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce * support for mandatory and extensible security protections. This notice * is included in support of clause 2.2 (b) of the Apple Public License, * Version 2.0. */ #include #include #include #include #include #include #include #include #include #include #include #include #include #include /* For _PC_NAME_MAX */ #include #include #include #include #if CONFIG_MACF #include #endif #include #include #if NAMEDRSRCFORK #include #endif /* * The minimum volfs-style pathname is 9. * Example: "/.vol/1/2" */ #define VOLFS_MIN_PATH_LEN 9 #if CONFIG_VOLFS static int vfs_getrealpath(const char * path, char * realpath, size_t bufsize, vfs_context_t ctx); #define MAX_VOLFS_RESTARTS 5 #endif static int lookup_traverse_mountpoints(struct nameidata *ndp, struct componentname *cnp, vnode_t dp, int vbusyflags, vfs_context_t ctx); static int lookup_handle_symlink(struct nameidata *ndp, vnode_t *new_dp, bool* dp_has_iocount, vfs_context_t ctx); static int lookup_authorize_search(vnode_t dp, struct componentname *cnp, int dp_authorized_in_cache, vfs_context_t ctx); static void lookup_consider_update_cache(vnode_t dvp, vnode_t vp, struct componentname *cnp, int nc_generation); static int lookup_handle_found_vnode(struct nameidata *ndp, struct componentname *cnp, int rdonly, int vbusyflags, int *keep_going, int nc_generation, int wantparent, int atroot, vfs_context_t ctx); static int lookup_handle_emptyname(struct nameidata *ndp, struct componentname *cnp, int wantparent); #if NAMEDRSRCFORK static int lookup_handle_rsrc_fork(vnode_t dp, struct nameidata *ndp, struct componentname *cnp, int wantparent, vfs_context_t ctx); #endif extern lck_rw_t rootvnode_rw_lock; /* * Convert a pathname into a pointer to a locked inode. * * The FOLLOW flag is set when symbolic links are to be followed * when they occur at the end of the name translation process. * Symbolic links are always followed for all other pathname * components other than the last. * * The segflg defines whether the name is to be copied from user * space or kernel space. * * Overall outline of namei: * * copy in name * get starting directory * while (!done && !error) { * call lookup to search path. * if symbolic link, massage name in buffer and continue * } * * Returns: 0 Success * ENOENT No such file or directory * ELOOP Too many levels of symbolic links * ENAMETOOLONG Filename too long * copyinstr:EFAULT Bad address * copyinstr:ENAMETOOLONG Filename too long * lookup:EBADF Bad file descriptor * lookup:EROFS * lookup:EACCES * lookup:EPERM * lookup:ERECYCLE vnode was recycled from underneath us in lookup. * This means we should re-drive lookup from this point. * lookup: ??? * VNOP_READLINK:??? */ int namei(struct nameidata *ndp) { struct vnode *dp; /* the directory we are searching */ struct vnode *usedvp = ndp->ni_dvp; /* store pointer to vp in case we must loop due to * heavy vnode pressure */ uint32_t cnpflags = ndp->ni_cnd.cn_flags; /* store in case we have to restore after loop */ int error; struct componentname *cnp = &ndp->ni_cnd; vfs_context_t ctx = cnp->cn_context; proc_t p = vfs_context_proc(ctx); #if CONFIG_AUDIT /* XXX ut should be from context */ uthread_t ut = current_uthread(); #endif #if CONFIG_VOLFS int volfs_restarts = 0; #endif size_t bytes_copied = 0; vnode_t rootdir_with_usecount = NULLVP; vnode_t startdir_with_usecount = NULLVP; vnode_t usedvp_dp = NULLVP; int32_t old_count = 0; bool dp_has_iocount = false; #if DIAGNOSTIC if (!vfs_context_ucred(ctx) || !p) { panic("namei: bad cred/proc"); } if (cnp->cn_nameiop & (~OPMASK)) { panic("namei: nameiop contaminated with flags"); } if (cnp->cn_flags & OPMASK) { panic("namei: flags contaminated with nameiops"); } #endif /* * A compound VNOP found something that needs further processing: * either a trigger vnode, a covered directory, or a symlink. */ if (ndp->ni_flag & NAMEI_CONTLOOKUP) { int rdonly, vbusyflags, keep_going, wantparent; rdonly = cnp->cn_flags & RDONLY; vbusyflags = ((cnp->cn_flags & CN_NBMOUNTLOOK) != 0) ? LK_NOWAIT : 0; keep_going = 0; wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT); ndp->ni_flag &= ~(NAMEI_CONTLOOKUP); error = lookup_handle_found_vnode(ndp, &ndp->ni_cnd, rdonly, vbusyflags, &keep_going, ndp->ni_ncgeneration, wantparent, 0, ctx); if (error) { goto out_drop; } if (keep_going) { if ((cnp->cn_flags & ISSYMLINK) == 0) { panic("We need to keep going on a continued lookup, but for vp type %d (tag %d)", ndp->ni_vp->v_type, ndp->ni_vp->v_tag); } goto continue_symlink; } return 0; } vnode_recycled: /* * Get a buffer for the name to be translated, and copy the * name into the buffer. */ if ((cnp->cn_flags & HASBUF) == 0) { cnp->cn_pnbuf = ndp->ni_pathbuf; cnp->cn_pnlen = PATHBUFLEN; } retry_copy: if (UIO_SEG_IS_USER_SPACE(ndp->ni_segflg)) { error = copyinstr(ndp->ni_dirp, cnp->cn_pnbuf, cnp->cn_pnlen, &bytes_copied); } else { error = copystr(CAST_DOWN(void *, ndp->ni_dirp), cnp->cn_pnbuf, cnp->cn_pnlen, &bytes_copied); } if (error == ENAMETOOLONG && !(cnp->cn_flags & HASBUF)) { cnp->cn_pnbuf = zalloc(ZV_NAMEI); cnp->cn_flags |= HASBUF; cnp->cn_pnlen = MAXPATHLEN; bytes_copied = 0; goto retry_copy; } if (error) { goto error_out; } assert(bytes_copied <= MAXPATHLEN); ndp->ni_pathlen = (u_int)bytes_copied; bytes_copied = 0; /* * Since the name cache may contain positive entries of * the incorrect case, force lookup() to bypass the cache * and call directly into the filesystem for each path * component. Note: the FS may still consult the cache, * but can apply rules to validate the results. */ if (proc_is_forcing_hfs_case_sensitivity(p)) { cnp->cn_flags |= CN_SKIPNAMECACHE; } #if CONFIG_VOLFS /* * Check for legacy volfs style pathnames. * * For compatibility reasons we currently allow these paths, * but future versions of the OS may not support them. */ if (ndp->ni_pathlen >= VOLFS_MIN_PATH_LEN && cnp->cn_pnbuf[0] == '/' && cnp->cn_pnbuf[1] == '.' && cnp->cn_pnbuf[2] == 'v' && cnp->cn_pnbuf[3] == 'o' && cnp->cn_pnbuf[4] == 'l' && cnp->cn_pnbuf[5] == '/') { char * realpath; int realpath_err; /* Attempt to resolve a legacy volfs style pathname. */ realpath = zalloc(ZV_NAMEI); /* * We only error out on the ENAMETOOLONG cases where we know that * vfs_getrealpath translation succeeded but the path could not fit into * MAXPATHLEN characters. In other failure cases, we may be dealing with a path * that legitimately looks like /.vol/1234/567 and is not meant to be translated */ if ((realpath_err = vfs_getrealpath(&cnp->cn_pnbuf[6], realpath, MAXPATHLEN, ctx))) { zfree(ZV_NAMEI, realpath); if (realpath_err == ENOSPC || realpath_err == ENAMETOOLONG) { error = ENAMETOOLONG; goto error_out; } } else { size_t tmp_len; if (cnp->cn_flags & HASBUF) { zfree(ZV_NAMEI, cnp->cn_pnbuf); } cnp->cn_pnbuf = realpath; cnp->cn_pnlen = MAXPATHLEN; tmp_len = strlen(realpath) + 1; assert(tmp_len <= UINT_MAX); ndp->ni_pathlen = (u_int)tmp_len; cnp->cn_flags |= HASBUF | CN_VOLFSPATH; } } #endif /* CONFIG_VOLFS */ #if CONFIG_AUDIT /* If we are auditing the kernel pathname, save the user pathname */ if (cnp->cn_flags & AUDITVNPATH1) { AUDIT_ARG(upath, ut->uu_cdir, cnp->cn_pnbuf, ARG_UPATH1); } if (cnp->cn_flags & AUDITVNPATH2) { AUDIT_ARG(upath, ut->uu_cdir, cnp->cn_pnbuf, ARG_UPATH2); } #endif /* CONFIG_AUDIT */ /* * Do not allow empty pathnames */ if (*cnp->cn_pnbuf == '\0') { error = ENOENT; goto error_out; } if (ndp->ni_flag & NAMEI_NOFOLLOW_ANY) { ndp->ni_loopcnt = MAXSYMLINKS; } else { ndp->ni_loopcnt = 0; } /* * determine the starting point for the translation. */ proc_dirs_lock_shared(p); lck_rw_lock_shared(&rootvnode_rw_lock); if (!(ndp->ni_flag & NAMEI_ROOTDIR)) { if (fdt_flag_test(&p->p_fd, FD_CHROOT)) { ndp->ni_rootdir = p->p_fd.fd_rdir; } else { ndp->ni_rootdir = rootvnode; } } if (!ndp->ni_rootdir) { if (ndp->ni_flag & NAMEI_ROOTDIR) { panic("NAMEI_ROOTDIR is set but ni_rootdir is not\n"); } else if (fdt_flag_test(&p->p_fd, FD_CHROOT)) { /* This should be a panic */ printf("p->p_fd.fd_rdir is not set\n"); } else { printf("rootvnode is not set\n"); } lck_rw_unlock_shared(&rootvnode_rw_lock); proc_dirs_unlock_shared(p); error = ENOENT; goto error_out; } cnp->cn_nameptr = cnp->cn_pnbuf; ndp->ni_usedvp = NULLVP; if (*(cnp->cn_nameptr) == '/') { while (*(cnp->cn_nameptr) == '/') { cnp->cn_nameptr++; ndp->ni_pathlen--; } dp = ndp->ni_rootdir; } else if (cnp->cn_flags & USEDVP) { dp = ndp->ni_dvp; ndp->ni_usedvp = dp; usedvp_dp = dp; } else { dp = vfs_context_cwd(ctx); } if (dp == NULLVP || (dp->v_lflag & VL_DEAD)) { dp = NULLVP; lck_rw_unlock_shared(&rootvnode_rw_lock); proc_dirs_unlock_shared(p); error = ENOENT; goto error_out; } /* * We need our own usecount on the root vnode and the starting dir across * the lookup. There's two things that be done here. We can hold the locks * (which protect the existing usecounts on the directories) across the * lookup or take our own usecount. Holding the locks across the lookup can * cause deadlock issues if we re-enter namei on the same thread so the * correct thing to do is to acquire our own usecount. * * Ideally, the usecount should be obtained by vnode_get->vnode_ref->vnode_put. * However when this vnode is the rootvnode, that sequence will produce a * lot of vnode mutex locks and unlocks on a single vnode (the rootvnode) * and will be highly contended and degrade performance. Since we have * an existing usecount protected by the locks we hold, we'll just use * an atomic op to increment the usecount on a vnode which already has one * and can't be released because we have the locks which protect against that * happening. */ rootdir_with_usecount = ndp->ni_rootdir; old_count = os_atomic_inc_orig(&rootdir_with_usecount->v_usecount, relaxed); if (old_count < 1) { panic("(1) invalid pre-increment usecount (%d) for rootdir vnode %p", old_count, rootdir_with_usecount); } else if (old_count == INT32_MAX) { panic("(1) usecount overflow for vnode %p", rootdir_with_usecount); } if ((dp != rootdir_with_usecount) && (dp != usedvp_dp)) { old_count = os_atomic_inc_orig(&dp->v_usecount, relaxed); if (old_count < 1) { panic("(2) invalid pre-increment usecount (%d) for vnode %p", old_count, dp); } else if (old_count == INT32_MAX) { panic("(2) usecount overflow for vnode %p", dp); } startdir_with_usecount = dp; } /* Now that we have our usecount, release the locks */ lck_rw_unlock_shared(&rootvnode_rw_lock); proc_dirs_unlock_shared(p); ndp->ni_dvp = NULLVP; ndp->ni_vp = NULLVP; for (;;) { #if CONFIG_MACF /* * Give MACF policies a chance to reject the lookup * before performing any filesystem operations. * This hook is called before resolving the path and * again each time a symlink is encountered. * NB: policies receive path information as supplied * by the caller and thus cannot be trusted. */ error = mac_vnode_check_lookup_preflight(ctx, dp, cnp->cn_nameptr, cnp->cn_namelen); if (error) { goto error_out; } #endif ndp->ni_startdir = dp; dp = NULLVP; if ((error = lookup(ndp))) { goto error_out; } /* * Check for symbolic link */ if ((cnp->cn_flags & ISSYMLINK) == 0) { if (startdir_with_usecount) { vnode_rele(startdir_with_usecount); startdir_with_usecount = NULLVP; } if (rootdir_with_usecount) { lck_rw_lock_shared(&rootvnode_rw_lock); if (rootdir_with_usecount == rootvnode) { old_count = os_atomic_dec_orig(&rootdir_with_usecount->v_usecount, relaxed); if (old_count < 2) { /* * There needs to have been at least 1 usecount left on the rootvnode */ panic("(3) Unexpected pre-decrement value (%d) of usecount for rootvnode %p", old_count, rootdir_with_usecount); } rootdir_with_usecount = NULLVP; } lck_rw_unlock_shared(&rootvnode_rw_lock); if (rootdir_with_usecount) { vnode_rele(rootdir_with_usecount); rootdir_with_usecount = NULLVP; } } return 0; } continue_symlink: /* Gives us a new path to process, and a starting dir */ error = lookup_handle_symlink(ndp, &dp, &dp_has_iocount, ctx); if (error != 0) { break; } if (dp_has_iocount) { if ((dp != rootdir_with_usecount) && (dp != startdir_with_usecount) && (dp != usedvp_dp)) { if (startdir_with_usecount) { vnode_rele(startdir_with_usecount); } vnode_ref_ext(dp, 0, VNODE_REF_FORCE); startdir_with_usecount = dp; } vnode_put(dp); dp_has_iocount = false; } } /* * only come here if we fail to handle a SYMLINK... * if either ni_dvp or ni_vp is non-NULL, then * we need to drop the iocount that was picked * up in the lookup routine */ out_drop: if (ndp->ni_dvp) { vnode_put(ndp->ni_dvp); } if (ndp->ni_vp) { vnode_put(ndp->ni_vp); } error_out: if (startdir_with_usecount) { vnode_rele(startdir_with_usecount); startdir_with_usecount = NULLVP; } if (rootdir_with_usecount) { lck_rw_lock_shared(&rootvnode_rw_lock); if (rootdir_with_usecount == rootvnode) { old_count = os_atomic_dec_orig(&rootdir_with_usecount->v_usecount, relaxed); if (old_count < 2) { /* * There needs to have been at least 1 usecount left on the rootvnode */ panic("(4) Unexpected pre-decrement value (%d) of usecount for rootvnode %p", old_count, rootdir_with_usecount); } lck_rw_unlock_shared(&rootvnode_rw_lock); } else { lck_rw_unlock_shared(&rootvnode_rw_lock); vnode_rele(rootdir_with_usecount); } rootdir_with_usecount = NULLVP; } if ((cnp->cn_flags & HASBUF)) { cnp->cn_flags &= ~HASBUF; zfree(ZV_NAMEI, cnp->cn_pnbuf); } cnp->cn_pnbuf = NULL; ndp->ni_vp = NULLVP; ndp->ni_dvp = NULLVP; #if CONFIG_VOLFS /* * Deal with volfs fallout. * * At this point, if we were originally given a volfs path that * looks like /.vol/123/456, then we would have had to convert it into * a full path. Assuming that part worked properly, we will now attempt * to conduct a lookup of the item in the namespace. Under normal * circumstances, if a user looked up /tmp/foo and it was not there, it * would be permissible to return ENOENT. * * However, we may not want to do that here. Specifically, the volfs path * uniquely identifies a certain item in the namespace regardless of where it * lives. If the item has moved in between the time we constructed the * path and now, when we're trying to do a lookup/authorization on the full * path, we may have gotten an ENOENT. * * At this point we can no longer tell if the path no longer exists * or if the item in question no longer exists. It could have been renamed * away, in which case the /.vol identifier is still valid. * * Do this dance a maximum of MAX_VOLFS_RESTARTS times. */ if ((error == ENOENT) && (ndp->ni_cnd.cn_flags & CN_VOLFSPATH)) { if (volfs_restarts < MAX_VOLFS_RESTARTS) { volfs_restarts++; goto vnode_recycled; } } #endif if (error == ERECYCLE) { /* vnode was recycled underneath us. re-drive lookup to start at * the beginning again, since recycling invalidated last lookup*/ ndp->ni_cnd.cn_flags = cnpflags; ndp->ni_dvp = usedvp; goto vnode_recycled; } return error; } int namei_compound_available(vnode_t dp, struct nameidata *ndp) { if ((ndp->ni_flag & NAMEI_COMPOUNDOPEN) != 0) { return vnode_compound_open_available(dp); } return 0; } static int lookup_authorize_search(vnode_t dp, struct componentname *cnp, int dp_authorized_in_cache, vfs_context_t ctx) { #if !CONFIG_MACF #pragma unused(cnp) #endif int error; if (!dp_authorized_in_cache) { error = vnode_authorize(dp, NULL, KAUTH_VNODE_SEARCH, ctx); if (error) { return error; } } #if CONFIG_MACF error = mac_vnode_check_lookup(ctx, dp, cnp); if (error) { return error; } #endif /* CONFIG_MACF */ return 0; } static void lookup_consider_update_cache(vnode_t dvp, vnode_t vp, struct componentname *cnp, int nc_generation) { int isdot_or_dotdot; isdot_or_dotdot = (cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.') || (cnp->cn_flags & ISDOTDOT); if (vp->v_name == NULL || vp->v_parent == NULLVP) { int update_flags = 0; if (isdot_or_dotdot == 0) { if (vp->v_name == NULL) { update_flags |= VNODE_UPDATE_NAME; } if (dvp != NULLVP && vp->v_parent == NULLVP) { update_flags |= VNODE_UPDATE_PARENT; } if (update_flags) { vnode_update_identity(vp, dvp, cnp->cn_nameptr, cnp->cn_namelen, cnp->cn_hash, update_flags); } } } if ((cnp->cn_flags & MAKEENTRY) && (vp->v_flag & VNCACHEABLE) && LIST_FIRST(&vp->v_nclinks) == NULL) { /* * missing from name cache, but should * be in it... this can happen if volfs * causes the vnode to be created or the * name cache entry got recycled but the * vnode didn't... * check to make sure that ni_dvp is valid * cache_lookup_path may return a NULL * do a quick check to see if the generation of the * directory matches our snapshot... this will get * rechecked behind the name cache lock, but if it * already fails to match, no need to go any further */ if (dvp != NULLVP && (nc_generation == dvp->v_nc_generation) && (!isdot_or_dotdot)) { cache_enter_with_gen(dvp, vp, cnp, nc_generation); } } } #if NAMEDRSRCFORK /* * Can change ni_dvp and ni_vp. On success, returns with iocounts on stream vnode (always) and * data fork if requested. On failure, returns with iocount data fork (always) and its parent directory * (if one was provided). */ static int lookup_handle_rsrc_fork(vnode_t dp, struct nameidata *ndp, struct componentname *cnp, int wantparent, vfs_context_t ctx) { vnode_t svp = NULLVP; enum nsoperation nsop; int nsflags; int error; if (dp->v_type != VREG) { error = ENOENT; goto out; } switch (cnp->cn_nameiop) { case DELETE: if (cnp->cn_flags & CN_ALLOWRSRCFORK) { nsop = NS_DELETE; } else { error = EPERM; goto out; } break; case CREATE: if (cnp->cn_flags & CN_ALLOWRSRCFORK) { nsop = NS_CREATE; } else { error = EPERM; goto out; } break; case LOOKUP: /* Make sure our lookup of "/..namedfork/rsrc" is allowed. */ if (cnp->cn_flags & CN_ALLOWRSRCFORK) { nsop = NS_OPEN; } else { error = EPERM; goto out; } break; default: error = EPERM; goto out; } nsflags = 0; if (cnp->cn_flags & CN_RAW_ENCRYPTED) { nsflags |= NS_GETRAWENCRYPTED; } /* Ask the file system for the resource fork. */ error = vnode_getnamedstream(dp, &svp, XATTR_RESOURCEFORK_NAME, nsop, nsflags, ctx); /* During a create, it OK for stream vnode to be missing. */ if (error == ENOATTR || error == ENOENT) { error = (nsop == NS_CREATE) ? 0 : ENOENT; } if (error) { goto out; } /* The "parent" of the stream is the file. */ if (wantparent) { if (ndp->ni_dvp) { vnode_put(ndp->ni_dvp); } ndp->ni_dvp = dp; } else { vnode_put(dp); } ndp->ni_vp = svp; /* on create this may be null */ /* Restore the truncated pathname buffer (for audits). */ if (ndp->ni_pathlen == 1 && ndp->ni_next[0] == '\0') { /* * While we replaced only '/' with '\0' and would ordinarily * need to just switch that back, the buffer in which we did * this may not be what the pathname buffer is now when symlinks * are involved. If we just restore the "/" we will make the * string not terminated anymore, so be safe and restore the * entire suffix. */ strncpy(ndp->ni_next, _PATH_RSRCFORKSPEC, sizeof(_PATH_RSRCFORKSPEC)); cnp->cn_nameptr = ndp->ni_next + 1; cnp->cn_namelen = sizeof(_PATH_RSRCFORKSPEC) - 1; ndp->ni_next += cnp->cn_namelen; if (ndp->ni_next[0] != '\0') { panic("Incorrect termination of path in %s", __FUNCTION__); } } cnp->cn_flags &= ~MAKEENTRY; return 0; out: return error; } #endif /* NAMEDRSRCFORK */ /* * iocounts in: * --One on ni_vp. One on ni_dvp if there is more path, or we didn't come through the * cache, or we came through the cache and the caller doesn't want the parent. * * iocounts out: * --Leaves us in the correct state for the next step, whatever that might be. * --If we find a symlink, returns with iocounts on both ni_vp and ni_dvp. * --If we are to look up another component, then we have an iocount on ni_vp and * nothing else. * --If we are done, returns an iocount on ni_vp, and possibly on ni_dvp depending on nameidata flags. * --In the event of an error, may return with ni_dvp NULL'ed out (in which case, iocount * was dropped). */ static int lookup_handle_found_vnode(struct nameidata *ndp, struct componentname *cnp, int rdonly, int vbusyflags, int *keep_going, int nc_generation, int wantparent, int atroot, vfs_context_t ctx) { vnode_t dp; int error; char *cp; dp = ndp->ni_vp; *keep_going = 0; if (ndp->ni_vp == NULLVP) { panic("NULL ni_vp in %s", __FUNCTION__); } if (atroot) { goto nextname; } /* * Take into account any additional components consumed by * the underlying filesystem. */ if (cnp->cn_consume > 0) { cnp->cn_nameptr += cnp->cn_consume; ndp->ni_next += cnp->cn_consume; ndp->ni_pathlen -= cnp->cn_consume; cnp->cn_consume = 0; } else { lookup_consider_update_cache(ndp->ni_dvp, dp, cnp, nc_generation); } /* * Check to see if the vnode has been mounted on... * if so find the root of the mounted file system. * Updates ndp->ni_vp. */ error = lookup_traverse_mountpoints(ndp, cnp, dp, vbusyflags, ctx); dp = ndp->ni_vp; if (error) { goto out; } #if CONFIG_MACF if (vfs_flags(vnode_mount(dp)) & MNT_MULTILABEL) { error = vnode_label(vnode_mount(dp), NULL, dp, NULL, 0, ctx); if (error) { goto out; } } #endif /* * Check for symbolic link */ if ((dp->v_type == VLNK) && ((cnp->cn_flags & FOLLOW) || (ndp->ni_flag & NAMEI_TRAILINGSLASH) || *ndp->ni_next == '/')) { cnp->cn_flags |= ISSYMLINK; *keep_going = 1; return 0; } /* * Check for bogus trailing slashes. */ if ((ndp->ni_flag & NAMEI_TRAILINGSLASH)) { if (dp->v_type != VDIR) { error = ENOTDIR; goto out; } ndp->ni_flag &= ~(NAMEI_TRAILINGSLASH); } #if NAMEDSTREAMS /* * Deny namei/lookup requests to resolve paths that point to shadow files. * Access to shadow files must be conducted by explicit calls to VNOP_LOOKUP * directly, and not use lookup/namei */ if (vnode_isshadow(dp)) { error = ENOENT; goto out; } #endif nextname: /* * Not a symbolic link. If more pathname, * continue at next component, else return. * * Definitely have a dvp if there's another slash */ if (*ndp->ni_next == '/') { cnp->cn_nameptr = ndp->ni_next + 1; ndp->ni_pathlen--; while (*cnp->cn_nameptr == '/') { cnp->cn_nameptr++; ndp->ni_pathlen--; } cp = cnp->cn_nameptr; vnode_put(ndp->ni_dvp); ndp->ni_dvp = NULLVP; if (*cp == '\0') { goto emptyname; } *keep_going = 1; return 0; } /* * Disallow directory write attempts on read-only file systems. */ if (rdonly && (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { error = EROFS; goto out; } /* If SAVESTART is set, we should have a dvp */ if (cnp->cn_flags & SAVESTART) { /* * note that we already hold a reference * on both dp and ni_dvp, but for some reason * can't get another one... in this case we * need to do vnode_put on dp in 'bad2' */ if ((vnode_get(ndp->ni_dvp))) { error = ENOENT; goto out; } ndp->ni_startdir = ndp->ni_dvp; } if (!wantparent && ndp->ni_dvp) { vnode_put(ndp->ni_dvp); ndp->ni_dvp = NULLVP; } if (cnp->cn_flags & AUDITVNPATH1) { AUDIT_ARG(vnpath, dp, ARG_VNODE1); } else if (cnp->cn_flags & AUDITVNPATH2) { AUDIT_ARG(vnpath, dp, ARG_VNODE2); } #if NAMEDRSRCFORK /* * Caller wants the resource fork. */ if ((cnp->cn_flags & CN_WANTSRSRCFORK) && (dp != NULLVP)) { error = lookup_handle_rsrc_fork(dp, ndp, cnp, wantparent, ctx); if (error != 0) { goto out; } dp = ndp->ni_vp; } #endif if (kdebug_enable) { kdebug_lookup(ndp->ni_vp, cnp); } return 0; emptyname: error = lookup_handle_emptyname(ndp, cnp, wantparent); if (error != 0) { goto out; } return 0; out: return error; } /* * Comes in iocount on ni_vp. May overwrite ni_dvp, but doesn't interpret incoming value. */ static int lookup_handle_emptyname(struct nameidata *ndp, struct componentname *cnp, int wantparent) { vnode_t dp; int error = 0; dp = ndp->ni_vp; cnp->cn_namelen = 0; /* * A degenerate name (e.g. / or "") which is a way of * talking about a directory, e.g. like "/." or ".". */ if (dp->v_type != VDIR) { error = ENOTDIR; goto out; } if (cnp->cn_nameiop == CREATE && dp == rootvnode) { error = EEXIST; goto out; } if (cnp->cn_nameiop != LOOKUP) { error = EISDIR; goto out; } if (wantparent) { /* * note that we already hold a reference * on dp, but for some reason can't * get another one... in this case we * need to do vnode_put on dp in 'bad' */ if ((vnode_get(dp))) { error = ENOENT; goto out; } ndp->ni_dvp = dp; } cnp->cn_flags &= ~ISDOTDOT; cnp->cn_flags |= ISLASTCN; ndp->ni_next = cnp->cn_nameptr; ndp->ni_vp = dp; if (cnp->cn_flags & AUDITVNPATH1) { AUDIT_ARG(vnpath, dp, ARG_VNODE1); } else if (cnp->cn_flags & AUDITVNPATH2) { AUDIT_ARG(vnpath, dp, ARG_VNODE2); } if (cnp->cn_flags & SAVESTART) { panic("lookup: SAVESTART"); } return 0; out: return error; } /* * Search a pathname. * This is a very central and rather complicated routine. * * The pathname is pointed to by ni_ptr and is of length ni_pathlen. * The starting directory is taken from ni_startdir. The pathname is * descended until done, or a symbolic link is encountered. The variable * ni_more is clear if the path is completed; it is set to one if a * symbolic link needing interpretation is encountered. * * The flag argument is LOOKUP, CREATE, RENAME, or DELETE depending on * whether the name is to be looked up, created, renamed, or deleted. * When CREATE, RENAME, or DELETE is specified, information usable in * creating, renaming, or deleting a directory entry may be calculated. * If flag has LOCKPARENT or'ed into it, the parent directory is returned * locked. If flag has WANTPARENT or'ed into it, the parent directory is * returned unlocked. Otherwise the parent directory is not returned. If * the target of the pathname exists and LOCKLEAF is or'ed into the flag * the target is returned locked, otherwise it is returned unlocked. * When creating or renaming and LOCKPARENT is specified, the target may not * be ".". When deleting and LOCKPARENT is specified, the target may be ".". * * Overall outline of lookup: * * dirloop: * identify next component of name at ndp->ni_ptr * handle degenerate case where name is null string * if .. and crossing mount points and on mounted filesys, find parent * call VNOP_LOOKUP routine for next component name * directory vnode returned in ni_dvp, unlocked unless LOCKPARENT set * component vnode returned in ni_vp (if it exists), locked. * if result vnode is mounted on and crossing mount points, * find mounted on vnode * if more components of name, do next level at dirloop * return the answer in ni_vp, locked if LOCKLEAF set * if LOCKPARENT set, return locked parent in ni_dvp * if WANTPARENT set, return unlocked parent in ni_dvp * * Returns: 0 Success * ENOENT No such file or directory * EBADF Bad file descriptor * ENOTDIR Not a directory * EROFS Read-only file system [CREATE] * EISDIR Is a directory [CREATE] * cache_lookup_path:ERECYCLE (vnode was recycled from underneath us, redrive lookup again) * vnode_authorize:EROFS * vnode_authorize:EACCES * vnode_authorize:EPERM * vnode_authorize:??? * VNOP_LOOKUP:ENOENT No such file or directory * VNOP_LOOKUP:EJUSTRETURN Restart system call (INTERNAL) * VNOP_LOOKUP:??? * VFS_ROOT:ENOTSUP * VFS_ROOT:ENOENT * VFS_ROOT:??? */ int lookup(struct nameidata *ndp) { char *cp; /* pointer into pathname argument */ vnode_t tdp; /* saved dp */ vnode_t dp; /* the directory we are searching */ int docache = 1; /* == 0 do not cache last component */ int wantparent; /* 1 => wantparent or lockparent flag */ int rdonly; /* lookup read-only flag bit */ int dp_authorized = 0; int error = 0; struct componentname *cnp = &ndp->ni_cnd; vfs_context_t ctx = cnp->cn_context; int vbusyflags = 0; int nc_generation = 0; vnode_t last_dp = NULLVP; int keep_going; int atroot; /* * Setup: break out flag bits into variables. */ if (cnp->cn_flags & NOCACHE) { docache = 0; } wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT); rdonly = cnp->cn_flags & RDONLY; cnp->cn_flags &= ~ISSYMLINK; cnp->cn_consume = 0; dp = ndp->ni_startdir; ndp->ni_startdir = NULLVP; if ((cnp->cn_flags & CN_NBMOUNTLOOK) != 0) { vbusyflags = LK_NOWAIT; } cp = cnp->cn_nameptr; if (*cp == '\0') { if ((vnode_getwithref(dp))) { dp = NULLVP; error = ENOENT; goto bad; } ndp->ni_vp = dp; error = lookup_handle_emptyname(ndp, cnp, wantparent); if (error) { goto bad; } return 0; } dirloop: atroot = 0; ndp->ni_vp = NULLVP; if ((error = cache_lookup_path(ndp, cnp, dp, ctx, &dp_authorized, last_dp))) { dp = NULLVP; goto bad; } if ((cnp->cn_flags & ISLASTCN)) { if (docache) { cnp->cn_flags |= MAKEENTRY; } } else { cnp->cn_flags |= MAKEENTRY; } dp = ndp->ni_dvp; if (ndp->ni_vp != NULLVP) { /* * cache_lookup_path returned a non-NULL ni_vp then, * we're guaranteed that the dp is a VDIR, it's * been authorized, and vp is not ".." * * make sure we don't try to enter the name back into * the cache if this vp is purged before we get to that * check since we won't have serialized behind whatever * activity is occurring in the FS that caused the purge */ if (dp != NULLVP) { nc_generation = dp->v_nc_generation - 1; } goto returned_from_lookup_path; } /* * Handle "..": two special cases. * 1. If at root directory (e.g. after chroot) * or at absolute root directory * then ignore it so can't get out. * 2. If this vnode is the root of a mounted * filesystem, then replace it with the * vnode which was mounted on so we take the * .. in the other file system. */ if ((cnp->cn_flags & ISDOTDOT)) { /* * if this is a chroot'ed process, check if the current * directory is still a subdirectory of the process's * root directory. */ if (ndp->ni_rootdir && (ndp->ni_rootdir != rootvnode) && dp != ndp->ni_rootdir) { int sdir_error; int is_subdir = FALSE; sdir_error = vnode_issubdir(dp, ndp->ni_rootdir, &is_subdir, vfs_context_kernel()); /* * If we couldn't determine if dp is a subdirectory of * ndp->ni_rootdir (sdir_error != 0), we let the request * proceed. */ if (!sdir_error && !is_subdir) { vnode_put(dp); dp = ndp->ni_rootdir; /* * There's a ref on the process's root directory * but we can't use vnode_getwithref here as * there is nothing preventing that ref being * released by another thread. */ if (vnode_get(dp)) { error = ENOENT; goto bad; } } } for (;;) { if (dp == ndp->ni_rootdir || dp == rootvnode) { ndp->ni_dvp = dp; ndp->ni_vp = dp; /* * we're pinned at the root * we've already got one reference on 'dp' * courtesy of cache_lookup_path... take * another one for the ".." * if we fail to get the new reference, we'll * drop our original down in 'bad' */ if ((vnode_get(dp))) { error = ENOENT; goto bad; } atroot = 1; goto returned_from_lookup_path; } if ((dp->v_flag & VROOT) == 0 || (cnp->cn_flags & NOCROSSMOUNT)) { break; } if (dp->v_mount == NULL) { /* forced umount */ error = EBADF; goto bad; } tdp = dp; dp = tdp->v_mount->mnt_vnodecovered; if ((vnode_getwithref(dp))) { vnode_put(tdp); dp = NULLVP; error = ENOENT; goto bad; } vnode_put(tdp); ndp->ni_dvp = dp; dp_authorized = 0; } } /* * We now have a segment name to search for, and a directory to search. */ #if CONFIG_UNION_MOUNTS unionlookup: #endif /* CONFIG_UNION_MOUNTS */ ndp->ni_vp = NULLVP; if (dp->v_type != VDIR) { error = ENOTDIR; goto lookup_error; } if ((cnp->cn_flags & DONOTAUTH) != DONOTAUTH) { error = lookup_authorize_search(dp, cnp, dp_authorized, ctx); if (error) { goto lookup_error; } } /* * Now that we've authorized a lookup, can bail out if the filesystem * will be doing a batched operation. Return an iocount on dvp. */ #if NAMEDRSRCFORK if ((cnp->cn_flags & ISLASTCN) && namei_compound_available(dp, ndp) && !(cnp->cn_flags & CN_WANTSRSRCFORK)) { #else if ((cnp->cn_flags & ISLASTCN) && namei_compound_available(dp, ndp)) { #endif /* NAMEDRSRCFORK */ ndp->ni_flag |= NAMEI_UNFINISHED; ndp->ni_ncgeneration = dp->v_nc_generation; return 0; } nc_generation = dp->v_nc_generation; /* * Note: * Filesystems that support hardlinks may want to call vnode_update_identity * if the lookup operation below will modify the in-core vnode to belong to a new point * in the namespace. VFS cannot infer whether or not the look up operation makes the vnode * name change or change parents. Without this, the lookup may make update * filesystem-specific in-core metadata but fail to update the v_parent or v_name * fields in the vnode. If VFS were to do this, it would be necessary to call * vnode_update_identity on every lookup operation -- expensive! * * However, even with this in place, multiple lookups may occur in between this lookup * and the subsequent vnop, so, at best, we could only guarantee that you would get a * valid path back, and not necessarily the one that you wanted. * * Example: * /tmp/a == /foo/b * * If you are now looking up /foo/b and the vnode for this link represents /tmp/a, * vnode_update_identity will fix the parentage so that you can get /foo/b back * through the v_parent chain (preventing you from getting /tmp/b back). It would * not fix whether or not you should or should not get /tmp/a vs. /foo/b. */ error = VNOP_LOOKUP(dp, &ndp->ni_vp, cnp, ctx); if (error) { lookup_error: #if CONFIG_UNION_MOUNTS if ((error == ENOENT) && (dp->v_mount != NULL) && (dp->v_mount->mnt_flag & MNT_UNION)) { tdp = dp; error = lookup_traverse_union(tdp, &dp, ctx); vnode_put(tdp); if (error) { dp = NULLVP; goto bad; } ndp->ni_dvp = dp; dp_authorized = 0; goto unionlookup; } #endif /* CONFIG_UNION_MOUNTS */ if (error != EJUSTRETURN) { goto bad; } if (ndp->ni_vp != NULLVP) { panic("leaf should be empty"); } #if NAMEDRSRCFORK /* * At this point, error should be EJUSTRETURN. * * If CN_WANTSRSRCFORK is set, that implies that the * underlying filesystem could not find the "parent" of the * resource fork (the data fork), and we are doing a lookup * for a CREATE event. * * However, this should be converted to an error, as the * failure to find this parent should disallow further * progress to try and acquire a resource fork vnode. */ if (cnp->cn_flags & CN_WANTSRSRCFORK) { error = ENOENT; goto bad; } #endif error = lookup_validate_creation_path(ndp); if (error) { goto bad; } /* * We return with ni_vp NULL to indicate that the entry * doesn't currently exist, leaving a pointer to the * referenced directory vnode in ndp->ni_dvp. */ if (cnp->cn_flags & SAVESTART) { if ((vnode_get(ndp->ni_dvp))) { error = ENOENT; goto bad; } ndp->ni_startdir = ndp->ni_dvp; } if (!wantparent) { vnode_put(ndp->ni_dvp); } if (kdebug_enable) { kdebug_lookup(ndp->ni_dvp, cnp); } return 0; } returned_from_lookup_path: /* We'll always have an iocount on ni_vp when this finishes. */ error = lookup_handle_found_vnode(ndp, cnp, rdonly, vbusyflags, &keep_going, nc_generation, wantparent, atroot, ctx); if (error != 0) { goto bad2; } if (keep_going) { dp = ndp->ni_vp; /* namei() will handle symlinks */ if ((dp->v_type == VLNK) && ((cnp->cn_flags & FOLLOW) || (ndp->ni_flag & NAMEI_TRAILINGSLASH) || *ndp->ni_next == '/')) { return 0; } /* * Otherwise, there's more path to process. * cache_lookup_path is now responsible for dropping io ref on dp * when it is called again in the dirloop. This ensures we hold * a ref on dp until we complete the next round of lookup. */ last_dp = dp; goto dirloop; } return 0; bad2: if (ndp->ni_dvp) { vnode_put(ndp->ni_dvp); } vnode_put(ndp->ni_vp); ndp->ni_vp = NULLVP; if (kdebug_enable) { kdebug_lookup(dp, cnp); } return error; bad: if (dp) { vnode_put(dp); } ndp->ni_vp = NULLVP; if (kdebug_enable) { kdebug_lookup(dp, cnp); } return error; } #if CONFIG_UNION_MOUNTS /* * Given a vnode in a union mount, traverse to the equivalent * vnode in the underlying mount. */ int lookup_traverse_union(vnode_t dvp, vnode_t *new_dvp, vfs_context_t ctx) { char *path = NULL, *pp; const char *name, *np; size_t len; int error = 0; struct nameidata nd; vnode_t vp = dvp; *new_dvp = NULL; if (vp && vp->v_flag & VROOT) { *new_dvp = vp->v_mount->mnt_vnodecovered; if (vnode_getwithref(*new_dvp)) { return ENOENT; } return 0; } path = zalloc_flags(ZV_NAMEI, Z_WAITOK | Z_NOFAIL); /* * Walk back up to the mountpoint following the * v_parent chain and build a slash-separated path. * Then lookup that path starting with the covered vnode. */ pp = path + (MAXPATHLEN - 1); *pp = '\0'; while (1) { name = vnode_getname(vp); if (name == NULL) { printf("lookup_traverse_union: null parent name: .%s\n", pp); error = ENOENT; goto done; } len = strlen(name); if ((len + 1) > (size_t)(pp - path)) { // Enough space for this name ? error = ENAMETOOLONG; vnode_putname(name); goto done; } for (np = name + len; len > 0; len--) { // Copy name backwards *--pp = *--np; } vnode_putname(name); vp = vp->v_parent; if (vp == NULLVP || vp->v_flag & VROOT) { break; } *--pp = '/'; } /* Evaluate the path in the underlying mount */ NDINIT(&nd, LOOKUP, OP_LOOKUP, USEDVP, UIO_SYSSPACE, CAST_USER_ADDR_T(pp), ctx); nd.ni_dvp = dvp->v_mount->mnt_vnodecovered; error = namei(&nd); if (error == 0) { *new_dvp = nd.ni_vp; } nameidone(&nd); done: if (path) { zfree(ZV_NAMEI, path); } return error; } #endif /* CONFIG_UNION_MOUNTS */ int lookup_validate_creation_path(struct nameidata *ndp) { struct componentname *cnp = &ndp->ni_cnd; /* * If creating and at end of pathname, then can consider * allowing file to be created. */ if (cnp->cn_flags & RDONLY) { return EROFS; } if ((cnp->cn_flags & ISLASTCN) && (ndp->ni_flag & NAMEI_TRAILINGSLASH) && !(cnp->cn_flags & WILLBEDIR)) { return ENOENT; } return 0; } /* * Modifies only ni_vp. Always returns with ni_vp still valid (iocount held). */ static int lookup_traverse_mountpoints(struct nameidata *ndp, struct componentname *cnp, vnode_t dp, int vbusyflags, vfs_context_t ctx) { mount_t mp; vnode_t tdp; int error = 0; uint32_t depth = 0; vnode_t mounted_on_dp; int current_mount_generation = 0; #if CONFIG_TRIGGERS vnode_t triggered_dp = NULLVP; int retry_cnt = 0; #define MAX_TRIGGER_RETRIES 1 #endif if (dp->v_type != VDIR || cnp->cn_flags & NOCROSSMOUNT) { return 0; } mounted_on_dp = dp; #if CONFIG_TRIGGERS restart: #endif current_mount_generation = mount_generation; while (dp->v_mountedhere) { vnode_lock_spin(dp); if ((mp = dp->v_mountedhere)) { mp->mnt_crossref++; vnode_unlock(dp); } else { vnode_unlock(dp); break; } if (ISSET(mp->mnt_lflag, MNT_LFORCE)) { mount_dropcrossref(mp, dp, 0); break; // don't traverse into a forced unmount } if (vfs_busy(mp, vbusyflags)) { mount_dropcrossref(mp, dp, 0); if (vbusyflags == LK_NOWAIT) { error = ENOENT; goto out; } continue; } error = VFS_ROOT(mp, &tdp, ctx); mount_dropcrossref(mp, dp, 0); vfs_unbusy(mp); if (error) { goto out; } vnode_put(dp); ndp->ni_vp = dp = tdp; if (dp->v_type != VDIR) { #if DEVELOPMENT || DEBUG panic("%s : Root of filesystem not a directory", __FUNCTION__); #else break; #endif } depth++; } #if CONFIG_TRIGGERS /* * The triggered_dp check here is required but is susceptible to a * (unlikely) race in which trigger mount is done from here and is * unmounted before we get past vfs_busy above. We retry to deal with * that case but it has the side effect of unwanted retries for * "special" processes which don't want to trigger mounts. */ if (dp->v_resolve && retry_cnt < MAX_TRIGGER_RETRIES) { error = vnode_trigger_resolve(dp, ndp, ctx); if (error) { goto out; } if (dp == triggered_dp) { retry_cnt += 1; } else { retry_cnt = 0; } triggered_dp = dp; goto restart; } #endif /* CONFIG_TRIGGERS */ if (depth) { mp = mounted_on_dp->v_mountedhere; if (mp) { mount_lock_spin(mp); mp->mnt_realrootvp_vid = dp->v_id; mp->mnt_realrootvp = dp; mp->mnt_generation = current_mount_generation; mount_unlock(mp); } } return 0; out: return error; } /* * Takes ni_vp and ni_dvp non-NULL. Returns with *new_dp set to the location * at which to start a lookup with a resolved path, and all other iocounts dropped. */ static int lookup_handle_symlink(struct nameidata *ndp, vnode_t *new_dp, bool *new_dp_has_iocount, vfs_context_t ctx) { int error; char *cp; /* pointer into pathname argument */ uio_t auio; UIO_STACKBUF(uio_buf, 1); int need_newpathbuf; u_int linklen = 0; struct componentname *cnp = &ndp->ni_cnd; vnode_t dp; char *tmppn; u_int rsrclen = (cnp->cn_flags & CN_WANTSRSRCFORK) ? sizeof(_PATH_RSRCFORKSPEC) : 0; bool dp_has_iocount = false; if (ndp->ni_loopcnt++ >= MAXSYMLINKS) { return ELOOP; } #if CONFIG_MACF if ((error = mac_vnode_check_readlink(ctx, ndp->ni_vp)) != 0) { return error; } #endif /* MAC */ if (ndp->ni_pathlen > 1 || !(cnp->cn_flags & HASBUF)) { need_newpathbuf = 1; } else { need_newpathbuf = 0; } if (need_newpathbuf) { cp = zalloc(ZV_NAMEI); } else { cp = cnp->cn_pnbuf; } auio = uio_createwithbuffer(1, 0, UIO_SYSSPACE, UIO_READ, &uio_buf[0], sizeof(uio_buf)); uio_addiov(auio, CAST_USER_ADDR_T(cp), MAXPATHLEN); error = VNOP_READLINK(ndp->ni_vp, auio, ctx); if (!error) { user_ssize_t resid = uio_resid(auio); assert(resid <= MAXPATHLEN); if (resid == MAXPATHLEN) { linklen = 0; } else { /* * Safe to set unsigned with a [larger] signed type here * because 0 <= uio_resid <= MAXPATHLEN and MAXPATHLEN * is only 1024. */ linklen = (u_int)strnlen(cp, MAXPATHLEN - (u_int)resid); } if (linklen == 0) { error = ENOENT; } else if (linklen + ndp->ni_pathlen + rsrclen > MAXPATHLEN) { error = ENAMETOOLONG; } } if (error) { if (need_newpathbuf) { zfree(ZV_NAMEI, cp); } return error; } if (need_newpathbuf) { tmppn = cnp->cn_pnbuf; bcopy(ndp->ni_next, cp + linklen, ndp->ni_pathlen); cnp->cn_pnbuf = cp; cnp->cn_pnlen = MAXPATHLEN; if ((cnp->cn_flags & HASBUF)) { zfree(ZV_NAMEI, tmppn); } else { cnp->cn_flags |= HASBUF; } } else { cnp->cn_pnbuf[linklen] = '\0'; } ndp->ni_pathlen += linklen; cnp->cn_nameptr = cnp->cn_pnbuf; /* * starting point for 'relative' * symbolic link path */ dp = ndp->ni_dvp; /* * get rid of reference returned via 'lookup' * ni_dvp is released only if we restart at /. */ vnode_put(ndp->ni_vp); ndp->ni_vp = NULLVP; ndp->ni_dvp = NULLVP; dp_has_iocount = true; /* * Check if symbolic link restarts us at the root */ if (*(cnp->cn_nameptr) == '/') { while (*(cnp->cn_nameptr) == '/') { cnp->cn_nameptr++; ndp->ni_pathlen--; } if (linklen != 0) { vnode_put(dp); /* ALWAYS have a dvp for a symlink */ dp_has_iocount = false; if ((dp = ndp->ni_rootdir) == NULLVP) { return ENOENT; } } } *new_dp = dp; *new_dp_has_iocount = dp_has_iocount; return 0; } /* * relookup - lookup a path name component * Used by lookup to re-aquire things. */ int relookup(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp) { struct vnode *dp = NULL; /* the directory we are searching */ int wantparent; /* 1 => wantparent or lockparent flag */ int rdonly; /* lookup read-only flag bit */ int error = 0; #ifdef NAMEI_DIAGNOSTIC int i, newhash; /* DEBUG: check name hash */ char *cp; /* DEBUG: check name ptr/len */ #endif vfs_context_t ctx = cnp->cn_context; /* * Setup: break out flag bits into variables. */ wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT); rdonly = cnp->cn_flags & RDONLY; cnp->cn_flags &= ~ISSYMLINK; if (cnp->cn_flags & NOCACHE) { cnp->cn_flags &= ~MAKEENTRY; } else { cnp->cn_flags |= MAKEENTRY; } dp = dvp; /* * Check for degenerate name (e.g. / or "") * which is a way of talking about a directory, * e.g. like "/." or ".". */ if (cnp->cn_nameptr[0] == '\0') { if (cnp->cn_nameiop != LOOKUP || wantparent) { error = EISDIR; goto bad; } if (dp->v_type != VDIR) { error = ENOTDIR; goto bad; } if ((vnode_get(dp))) { error = ENOENT; goto bad; } *vpp = dp; if (cnp->cn_flags & SAVESTART) { panic("lookup: SAVESTART"); } return 0; } /* * We now have a segment name to search for, and a directory to search. */ if ((error = VNOP_LOOKUP(dp, vpp, cnp, ctx))) { if (error != EJUSTRETURN) { goto bad; } #if DIAGNOSTIC if (*vpp != NULL) { panic("leaf should be empty"); } #endif /* * If creating and at end of pathname, then can consider * allowing file to be created. */ if (rdonly) { error = EROFS; goto bad; } /* * We return with ni_vp NULL to indicate that the entry * doesn't currently exist, leaving a pointer to the * (possibly locked) directory inode in ndp->ni_dvp. */ return 0; } dp = *vpp; #if DIAGNOSTIC /* * Check for symbolic link */ if (dp->v_type == VLNK && (cnp->cn_flags & FOLLOW)) { panic("relookup: symlink found."); } #endif /* * Disallow directory write attempts on read-only file systems. */ if (rdonly && (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { error = EROFS; goto bad2; } /* ASSERT(dvp == ndp->ni_startdir) */ return 0; bad2: vnode_put(dp); bad: *vpp = NULL; return error; } /* * Free pathname buffer */ void nameidone(struct nameidata *ndp) { if (ndp->ni_cnd.cn_flags & HASBUF) { char *tmp = ndp->ni_cnd.cn_pnbuf; ndp->ni_cnd.cn_pnbuf = NULL; ndp->ni_cnd.cn_flags &= ~HASBUF; zfree(ZV_NAMEI, tmp); } } /* * Log (part of) a pathname using kdebug, as used by fs_usage. The path up to * and including the current component name are logged. Up to NUMPARMS * 4 * bytes of pathname will be logged. If the path to be logged is longer than * that, then the last NUMPARMS * 4 bytes are logged. That is, the truncation * removes the leading portion of the path. * * The logging is done via multiple KDBG_RELEASE calls. The first one is marked * with DBG_FUNC_START. The last one is marked with DBG_FUNC_END (in addition * to DBG_FUNC_START if it is also the first). There may be intermediate ones * with neither DBG_FUNC_START nor DBG_FUNC_END. * * The first event passes the vnode pointer and 24 or 32 (on K32, 12 or 24) * bytes of pathname. The remaining events add 32 (on K32, 16) bytes of * pathname each. The minimum number of events required to pass the path are * used. Any excess padding in the final event (because not all of the 24 or 32 * (on K32, 12 or 16) bytes are needed for the remainder of the path) is set to * zero bytes, or '>' if there is more path beyond the current component name * (usually because an intermediate component was not found). * * NOTE: If the path length is greater than NUMPARMS * 4, or is not of the form * 24 + N * 32 (or on K32, 12 + N * 16), there will be no padding. */ #if (KDEBUG_LEVEL >= KDEBUG_LEVEL_IST) void kdebug_vfs_lookup(unsigned long *path_words, int path_len, void *vnp, uint32_t flags) { bool noprocfilt = flags & KDBG_VFS_LOOKUP_FLAG_NOPROCFILT; assert(path_len >= 0); int code = ((flags & KDBG_VFS_LOOKUP_FLAG_LOOKUP) ? VFS_LOOKUP : VFS_LOOKUP_DONE) | DBG_FUNC_START; if (path_len <= (3 * (int)sizeof(long))) { code |= DBG_FUNC_END; } if (noprocfilt) { KDBG_RELEASE_NOPROCFILT(code, kdebug_vnode(vnp), path_words[0], path_words[1], path_words[2]); } else { KDBG_RELEASE(code, kdebug_vnode(vnp), path_words[0], path_words[1], path_words[2]); } code &= ~DBG_FUNC_START; for (int i = 3; i * (int)sizeof(long) < path_len; i += 4) { if ((i + 4) * (int)sizeof(long) >= path_len) { code |= DBG_FUNC_END; } if (noprocfilt) { KDBG_RELEASE_NOPROCFILT(code, path_words[i], path_words[i + 1], path_words[i + 2], path_words[i + 3]); } else { KDBG_RELEASE(code, path_words[i], path_words[i + 1], path_words[i + 2], path_words[i + 3]); } } } void kdebug_lookup_gen_events(long *path_words, int path_len, void *vnp, bool lookup) { assert(path_len >= 0); kdebug_vfs_lookup((unsigned long *)path_words, path_len, vnp, lookup ? KDBG_VFS_LOOKUP_FLAG_LOOKUP : 0); } void kdebug_lookup(vnode_t vnp, struct componentname *cnp) { unsigned long path_words[NUMPARMS]; /* * Truncate the leading portion of the path to fit in path_words. */ char *path_end = cnp->cn_nameptr + cnp->cn_namelen; size_t path_len = MIN(path_end - cnp->cn_pnbuf, (ssize_t)sizeof(path_words)); assert(path_len >= 0); char *path_trunc = path_end - path_len; memcpy(path_words, path_trunc, path_len); /* * Pad with '\0' or '>'. */ if (path_len < (ssize_t)sizeof(path_words)) { bool complete_str = *(cnp->cn_nameptr + cnp->cn_namelen) == '\0'; memset((char *)path_words + path_len, complete_str ? '\0' : '>', sizeof(path_words) - path_len); } kdebug_vfs_lookup(path_words, (int)path_len, vnp, KDBG_VFS_LOOKUP_FLAG_LOOKUP); } #else /* (KDEBUG_LEVEL >= KDEBUG_LEVEL_IST) */ void kdebug_vfs_lookup(long *dbg_parms __unused, int dbg_namelen __unused, void *dp __unused, __unused uint32_t flags) { } static void kdebug_lookup(struct vnode *dp __unused, struct componentname *cnp __unused) { } #endif /* (KDEBUG_LEVEL >= KDEBUG_LEVEL_IST) */ int vfs_getbyid(fsid_t *fsid, ino64_t ino, vnode_t *vpp, vfs_context_t ctx) { mount_t mp; int error; mp = mount_lookupby_volfsid(fsid->val[0], 1); if (mp == NULL) { return EINVAL; } /* Get the target vnode. */ if (ino == 2) { error = VFS_ROOT(mp, vpp, ctx); } else { error = VFS_VGET(mp, ino, vpp, ctx); } vfs_unbusy(mp); return error; } /* * Obtain the real path from a legacy volfs style path. * * Valid formats of input path: * * "555/@" * "555/2" * "555/123456" * "555/123456/foobar" * * Where: * 555 represents the volfs file system id * '@' and '2' are aliases to the root of a file system * 123456 represents a file id * "foobar" represents a file name */ #if CONFIG_VOLFS static int vfs_getrealpath(const char * path, char * realpath, size_t bufsize, vfs_context_t ctx) { vnode_t vp; struct mount *mp = NULL; char *str; char ch; unsigned long id; ino64_t ino; int error; int length; /* Get file system id and move str to next component. */ id = strtoul(path, &str, 10); if (id == 0 || str[0] != '/') { return EINVAL; } while (*str == '/') { str++; } ch = *str; if (id > INT_MAX) { return ENOENT; } mp = mount_lookupby_volfsid((int)id, 1); if (mp == NULL) { return EINVAL; /* unexpected failure */ } /* Check for an alias to a file system root. */ if (ch == '@' && str[1] == '\0') { ino = 2; str++; } else { /* Get file id and move str to next component. */ ino = strtouq(str, &str, 10); } /* Get the target vnode. */ if (ino == 2) { struct vfs_attr vfsattr; int use_vfs_root = TRUE; VFSATTR_INIT(&vfsattr); VFSATTR_WANTED(&vfsattr, f_capabilities); if (vfs_getattr(mp, &vfsattr, vfs_context_kernel()) == 0 && VFSATTR_IS_SUPPORTED(&vfsattr, f_capabilities)) { if ((vfsattr.f_capabilities.capabilities[VOL_CAPABILITIES_FORMAT] & VOL_CAP_FMT_VOL_GROUPS) && (vfsattr.f_capabilities.valid[VOL_CAPABILITIES_FORMAT] & VOL_CAP_FMT_VOL_GROUPS)) { use_vfs_root = FALSE; } } if (use_vfs_root) { error = VFS_ROOT(mp, &vp, ctx); } else { error = VFS_VGET(mp, ino, &vp, ctx); } } else { error = VFS_VGET(mp, ino, &vp, ctx); } vfs_unbusy(mp); if (error) { goto out; } realpath[0] = '\0'; /* Get the absolute path to this vnode. */ error = build_path(vp, realpath, (int)bufsize, &length, 0, ctx); vnode_put(vp); if (error == 0 && *str != '\0') { size_t attempt = strlcat(realpath, str, MAXPATHLEN); if (attempt > MAXPATHLEN) { error = ENAMETOOLONG; } } out: return error; } #endif void lookup_compound_vnop_post_hook(int error, vnode_t dvp, vnode_t vp, struct nameidata *ndp, int did_create) { if (error == 0 && vp == NULLVP) { panic("NULL vp with error == 0."); } /* * We don't want to do any of this if we didn't use the compound vnop * to perform the lookup... i.e. if we're allowing and using the legacy pattern, * where we did a full lookup. */ if ((ndp->ni_flag & NAMEI_COMPOUND_OP_MASK) == 0) { return; } /* * If we're going to continue the lookup, we'll handle * all lookup-related updates at that time. */ if (error == EKEEPLOOKING) { return; } /* * Only audit or update cache for *found* vnodes. For creation * neither would happen in the non-compound-vnop case. */ if ((vp != NULLVP) && !did_create) { /* * If MAKEENTRY isn't set, and we've done a successful compound VNOP, * then we certainly don't want to update cache or identity. */ if ((error != 0) || (ndp->ni_cnd.cn_flags & MAKEENTRY)) { lookup_consider_update_cache(dvp, vp, &ndp->ni_cnd, ndp->ni_ncgeneration); } if (ndp->ni_cnd.cn_flags & AUDITVNPATH1) { AUDIT_ARG(vnpath, vp, ARG_VNODE1); } else if (ndp->ni_cnd.cn_flags & AUDITVNPATH2) { AUDIT_ARG(vnpath, vp, ARG_VNODE2); } } /* * If you created (whether you opened or not), cut a lookup tracepoint * for the parent dir (as would happen without a compound vnop). Note: we may need * a vnode despite failure in this case! * * If you did not create: * Found child (succeeded or not): cut a tracepoint for the child. * Did not find child: cut a tracepoint with the parent. */ if (kdebug_enable) { kdebug_lookup(vp ? vp : dvp, &ndp->ni_cnd); } }