sys/kern/subr_acl_nfs4.c

   1 /*-
   2  * Copyright (c) 2008-2010 Edward Tomasz Napierała <trasz@FreeBSD.org>
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  24  * SUCH DAMAGE.
  25  */
  26
  27 /*
  28  * ACL support routines specific to NFSv4 access control lists.  These are
  29  * utility routines for code common across file systems implementing NFSv4
  30  * ACLs.
  31  */
  32
  33 #ifdef _KERNEL
  34 #include <sys/cdefs.h>
  35 __FBSDID("$FreeBSD$");
  36
  37 #include <sys/param.h>
  38 #include <sys/systm.h>
  39 #include <sys/mount.h>
  40 #include <sys/priv.h>
  41 #include <sys/vnode.h>
  42 #include <sys/errno.h>
  43 #include <sys/stat.h>
  44 #include <sys/sysctl.h>
  45 #include <sys/acl.h>
  46 #else
  47 #include <errno.h>
  48 #include <assert.h>
  49 #include <sys/acl.h>
  50 #include <sys/stat.h>
  51 #define KASSERT(a, b) assert(a)
  52 #define CTASSERT(a)
  53
  54 #endif /* !_KERNEL */
  55
  56 #ifdef _KERNEL
  57
  58 static void     acl_nfs4_trivial_from_mode(struct acl *aclp, mode_t mode);
  59
  60 static int      acl_nfs4_old_semantics = 0;
  61
  62 SYSCTL_INT(_vfs, OID_AUTO, acl_nfs4_old_semantics, CTLFLAG_RW,
  63     &acl_nfs4_old_semantics, 0, "Use pre-PSARC/2010/029 NFSv4 ACL semantics");
  64
  65 static struct {
  66         accmode_t accmode;
  67         int mask;
  68 } accmode2mask[] = {{VREAD, ACL_READ_DATA},
  69                     {VWRITE, ACL_WRITE_DATA},
  70                     {VAPPEND, ACL_APPEND_DATA},
  71                     {VEXEC, ACL_EXECUTE},
  72                     {VREAD_NAMED_ATTRS, ACL_READ_NAMED_ATTRS},
  73                     {VWRITE_NAMED_ATTRS, ACL_WRITE_NAMED_ATTRS},
  74                     {VDELETE_CHILD, ACL_DELETE_CHILD},
  75                     {VREAD_ATTRIBUTES, ACL_READ_ATTRIBUTES},
  76                     {VWRITE_ATTRIBUTES, ACL_WRITE_ATTRIBUTES},
  77                     {VDELETE, ACL_DELETE},
  78                     {VREAD_ACL, ACL_READ_ACL},
  79                     {VWRITE_ACL, ACL_WRITE_ACL},
  80                     {VWRITE_OWNER, ACL_WRITE_OWNER},
  81                     {VSYNCHRONIZE, ACL_SYNCHRONIZE},
  82                     {0, 0}};
  83
  84 static int
  85 _access_mask_from_accmode(accmode_t accmode)
  86 {
  87         int access_mask = 0, i;
  88
  89         for (i = 0; accmode2mask[i].accmode != 0; i++) {
  90                 if (accmode & accmode2mask[i].accmode)
  91                         access_mask |= accmode2mask[i].mask;
  92         }
  93
  94         /*
  95          * VAPPEND is just a modifier for VWRITE; if the caller asked
  96          * for 'VAPPEND | VWRITE', we want to check for ACL_APPEND_DATA only.
  97          */
  98         if (access_mask & ACL_APPEND_DATA)
  99                 access_mask &= ~ACL_WRITE_DATA;
 100
 101         return (access_mask);
 102 }
 103
 104 /*
 105  * Return 0, iff access is allowed, 1 otherwise.
 106  */
 107 static int
 108 _acl_denies(const struct acl *aclp, int access_mask, struct ucred *cred,
 109     int file_uid, int file_gid, int *denied_explicitly)
 110 {
 111         int i;
 112         const struct acl_entry *entry;
 113
 114         if (denied_explicitly != NULL)
 115                 *denied_explicitly = 0;
 116
 117         KASSERT(aclp->acl_cnt <= ACL_MAX_ENTRIES,
 118             ("aclp->acl_cnt <= ACL_MAX_ENTRIES"));
 119
 120         for (i = 0; i < aclp->acl_cnt; i++) {
 121                 entry = &(aclp->acl_entry[i]);
 122
 123                 if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW &&
 124                     entry->ae_entry_type != ACL_ENTRY_TYPE_DENY)
 125                         continue;
 126                 if (entry->ae_flags & ACL_ENTRY_INHERIT_ONLY)
 127                         continue;
 128                 switch (entry->ae_tag) {
 129                 case ACL_USER_OBJ:
 130                         if (file_uid != cred->cr_uid)
 131                                 continue;
 132                         break;
 133                 case ACL_USER:
 134                         if (entry->ae_id != cred->cr_uid)
 135                                 continue;
 136                         break;
 137                 case ACL_GROUP_OBJ:
 138                         if (!groupmember(file_gid, cred))
 139                                 continue;
 140                         break;
 141                 case ACL_GROUP:
 142                         if (!groupmember(entry->ae_id, cred))
 143                                 continue;
 144                         break;
 145                 default:
 146                         KASSERT(entry->ae_tag == ACL_EVERYONE,
 147                             ("entry->ae_tag == ACL_EVERYONE"));
 148                 }
 149
 150                 if (entry->ae_entry_type == ACL_ENTRY_TYPE_DENY) {
 151                         if (entry->ae_perm & access_mask) {
 152                                 if (denied_explicitly != NULL)
 153                                         *denied_explicitly = 1;
 154                                 return (1);
 155                         }
 156                 }
 157
 158                 access_mask &= ~(entry->ae_perm);
 159                 if (access_mask == 0)
 160                         return (0);
 161         }
 162
 163         return (1);
 164 }
 165
 166 int
 167 vaccess_acl_nfs4(enum vtype type, uid_t file_uid, gid_t file_gid,
 168     struct acl *aclp, accmode_t accmode, struct ucred *cred, int *privused)
 169 {
 170         accmode_t priv_granted = 0;
 171         int denied, explicitly_denied, access_mask, is_directory,
 172             must_be_owner = 0;
 173         mode_t file_mode = 0;
 174
 175         KASSERT((accmode & ~(VEXEC | VWRITE | VREAD | VADMIN | VAPPEND |
 176             VEXPLICIT_DENY | VREAD_NAMED_ATTRS | VWRITE_NAMED_ATTRS |
 177             VDELETE_CHILD | VREAD_ATTRIBUTES | VWRITE_ATTRIBUTES | VDELETE |
 178             VREAD_ACL | VWRITE_ACL | VWRITE_OWNER | VSYNCHRONIZE)) == 0,
 179             ("invalid bit in accmode"));
 180         KASSERT((accmode & VAPPEND) == 0 || (accmode & VWRITE),
 181                 ("VAPPEND without VWRITE"));
 182
 183         if (privused != NULL)
 184                 *privused = 0;
 185
 186         if (accmode & VADMIN)
 187                 must_be_owner = 1;
 188
 189         /*
 190          * Ignore VSYNCHRONIZE permission.
 191          */
 192         accmode &= ~VSYNCHRONIZE;
 193
 194         access_mask = _access_mask_from_accmode(accmode);
 195
 196         if (type == VDIR)
 197                 is_directory = 1;
 198         else
 199                 is_directory = 0;
 200
 201         /*
 202          * File owner is always allowed to read and write the ACL
 203          * and basic attributes.  This is to prevent a situation
 204          * where user would change ACL in a way that prevents him
 205          * from undoing the change.
 206          */
 207         if (file_uid == cred->cr_uid)
 208                 access_mask &= ~(ACL_READ_ACL | ACL_WRITE_ACL |
 209                     ACL_READ_ATTRIBUTES | ACL_WRITE_ATTRIBUTES);
 210
 211         /*
 212          * Ignore append permission for regular files; use write
 213          * permission instead.
 214          */
 215         if (!is_directory && (access_mask & ACL_APPEND_DATA)) {
 216                 access_mask &= ~ACL_APPEND_DATA;
 217                 access_mask |= ACL_WRITE_DATA;
 218         }
 219
 220         denied = _acl_denies(aclp, access_mask, cred, file_uid, file_gid,
 221             &explicitly_denied);
 222
 223         if (must_be_owner) {
 224                 if (file_uid != cred->cr_uid)
 225                         denied = EPERM;
 226         }
 227
 228         /*
 229          * For VEXEC, ensure that at least one execute bit is set for
 230          * non-directories. We have to check the mode here to stay
 231          * consistent with execve(2). See the test in
 232          * exec_check_permissions().
 233          */
 234         acl_nfs4_sync_mode_from_acl(&file_mode, aclp);
 235         if (!denied && !is_directory && (accmode & VEXEC) &&
 236             (file_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0)
 237                 denied = EACCES;
 238
 239         if (!denied)
 240                 return (0);
 241
 242         /*
 243          * Access failed.  Iff it was not denied explicitly and
 244          * VEXPLICIT_DENY flag was specified, allow access.
 245          */
 246         if ((accmode & VEXPLICIT_DENY) && explicitly_denied == 0)
 247                 return (0);
 248
 249         accmode &= ~VEXPLICIT_DENY;
 250
 251         /*
 252          * No match.  Try to use privileges, if there are any.
 253          */
 254         if (is_directory) {
 255                 if ((accmode & VEXEC) && !priv_check_cred(cred,
 256                     PRIV_VFS_LOOKUP, 0))
 257                         priv_granted |= VEXEC;
 258         } else {
 259                 /*
 260                  * Ensure that at least one execute bit is on. Otherwise,
 261                  * a privileged user will always succeed, and we don't want
 262                  * this to happen unless the file really is executable.
 263                  */
 264                 if ((accmode & VEXEC) && (file_mode &
 265                     (S_IXUSR | S_IXGRP | S_IXOTH)) != 0 &&
 266                     !priv_check_cred(cred, PRIV_VFS_EXEC, 0))
 267                         priv_granted |= VEXEC;
 268         }
 269
 270         if ((accmode & VREAD) && !priv_check_cred(cred, PRIV_VFS_READ, 0))
 271                 priv_granted |= VREAD;
 272
 273         if ((accmode & (VWRITE | VAPPEND | VDELETE_CHILD)) &&
 274             !priv_check_cred(cred, PRIV_VFS_WRITE, 0))
 275                 priv_granted |= (VWRITE | VAPPEND | VDELETE_CHILD);
 276
 277         if ((accmode & VADMIN_PERMS) &&
 278             !priv_check_cred(cred, PRIV_VFS_ADMIN, 0))
 279                 priv_granted |= VADMIN_PERMS;
 280
 281         if ((accmode & VSTAT_PERMS) &&
 282             !priv_check_cred(cred, PRIV_VFS_STAT, 0))
 283                 priv_granted |= VSTAT_PERMS;
 284
 285         if ((accmode & priv_granted) == accmode) {
 286                 if (privused != NULL)
 287                         *privused = 1;
 288
 289                 return (0);
 290         }
 291
 292         if (accmode & (VADMIN_PERMS | VDELETE_CHILD | VDELETE))
 293                 denied = EPERM;
 294         else
 295                 denied = EACCES;
 296
 297         return (denied);
 298 }
 299 #endif /* _KERNEL */
 300
 301 static int
 302 _acl_entry_matches(struct acl_entry *entry, acl_tag_t tag, acl_perm_t perm,
 303     acl_entry_type_t entry_type)
 304 {
 305         if (entry->ae_tag != tag)
 306                 return (0);
 307
 308         if (entry->ae_id != ACL_UNDEFINED_ID)
 309                 return (0);
 310
 311         if (entry->ae_perm != perm)
 312                 return (0);
 313
 314         if (entry->ae_entry_type != entry_type)
 315                 return (0);
 316
 317         if (entry->ae_flags != 0)
 318                 return (0);
 319
 320         return (1);
 321 }
 322
 323 static struct acl_entry *
 324 _acl_append(struct acl *aclp, acl_tag_t tag, acl_perm_t perm,
 325     acl_entry_type_t entry_type)
 326 {
 327         struct acl_entry *entry;
 328
 329         KASSERT(aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES,
 330             ("aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES"));
 331
 332         entry = &(aclp->acl_entry[aclp->acl_cnt]);
 333         aclp->acl_cnt++;
 334
 335         entry->ae_tag = tag;
 336         entry->ae_id = ACL_UNDEFINED_ID;
 337         entry->ae_perm = perm;
 338         entry->ae_entry_type = entry_type;
 339         entry->ae_flags = 0;
 340
 341         return (entry);
 342 }
 343
 344 static struct acl_entry *
 345 _acl_duplicate_entry(struct acl *aclp, int entry_index)
 346 {
 347         int i;
 348
 349         KASSERT(aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES,
 350             ("aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES"));
 351
 352         for (i = aclp->acl_cnt; i > entry_index; i--)
 353                 aclp->acl_entry[i] = aclp->acl_entry[i - 1];
 354
 355         aclp->acl_cnt++;
 356
 357         return (&(aclp->acl_entry[entry_index + 1]));
 358 }
 359
 360 static void
 361 acl_nfs4_sync_acl_from_mode_draft(struct acl *aclp, mode_t mode,
 362     int file_owner_id)
 363 {
 364         int i, meets, must_append;
 365         struct acl_entry *entry, *copy, *previous,
 366             *a1, *a2, *a3, *a4, *a5, *a6;
 367         mode_t amode;
 368         const int READ = 04;
 369         const int WRITE = 02;
 370         const int EXEC = 01;
 371
 372         KASSERT(aclp->acl_cnt <= ACL_MAX_ENTRIES,
 373             ("aclp->acl_cnt <= ACL_MAX_ENTRIES"));
 374
 375         /*
 376          * NFSv4 Minor Version 1, draft-ietf-nfsv4-minorversion1-03.txt
 377          *
 378          * 3.16.6.3. Applying a Mode to an Existing ACL
 379          */
 380
 381         /*
 382          * 1. For each ACE:
 383          */
 384         for (i = 0; i < aclp->acl_cnt; i++) {
 385                 entry = &(aclp->acl_entry[i]);
 386
 387                 /*
 388                  * 1.1. If the type is neither ALLOW or DENY - skip.
 389                  */
 390                 if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW &&
 391                     entry->ae_entry_type != ACL_ENTRY_TYPE_DENY)
 392                         continue;
 393
 394                 /*
 395                  * 1.2. If ACL_ENTRY_INHERIT_ONLY is set - skip.
 396                  */
 397                 if (entry->ae_flags & ACL_ENTRY_INHERIT_ONLY)
 398                         continue;
 399
 400                 /*
 401                  * 1.3. If ACL_ENTRY_FILE_INHERIT or ACL_ENTRY_DIRECTORY_INHERIT
 402                  *      are set:
 403                  */
 404                 if (entry->ae_flags &
 405                     (ACL_ENTRY_FILE_INHERIT | ACL_ENTRY_DIRECTORY_INHERIT)) {
 406                         /*
 407                          * 1.3.1. A copy of the current ACE is made, and placed
 408                          *        in the ACL immediately following the current
 409                          *        ACE.
 410                          */
 411                         copy = _acl_duplicate_entry(aclp, i);
 412
 413                         /*
 414                          * 1.3.2. In the first ACE, the flag
 415                          *        ACL_ENTRY_INHERIT_ONLY is set.
 416                          */
 417                         entry->ae_flags |= ACL_ENTRY_INHERIT_ONLY;
 418
 419                         /*
 420                          * 1.3.3. In the second ACE, the following flags
 421                          *        are cleared:
 422                          *        ACL_ENTRY_FILE_INHERIT,
 423                          *        ACL_ENTRY_DIRECTORY_INHERIT,
 424                          *        ACL_ENTRY_NO_PROPAGATE_INHERIT.
 425                          */
 426                         copy->ae_flags &= ~(ACL_ENTRY_FILE_INHERIT |
 427                             ACL_ENTRY_DIRECTORY_INHERIT |
 428                             ACL_ENTRY_NO_PROPAGATE_INHERIT);
 429
 430                         /*
 431                          * The algorithm continues on with the second ACE.
 432                          */
 433                         i++;
 434                         entry = copy;
 435                 }
 436
 437                 /*
 438                  * 1.4. If it's owner@, group@ or everyone@ entry, clear
 439                  *      ACL_READ_DATA, ACL_WRITE_DATA, ACL_APPEND_DATA
 440                  *      and ACL_EXECUTE.  Continue to the next entry.
 441                  */
 442                 if (entry->ae_tag == ACL_USER_OBJ ||
 443                     entry->ae_tag == ACL_GROUP_OBJ ||
 444                     entry->ae_tag == ACL_EVERYONE) {
 445                         entry->ae_perm &= ~(ACL_READ_DATA | ACL_WRITE_DATA |
 446                             ACL_APPEND_DATA | ACL_EXECUTE);
 447                         continue;
 448                 }
 449
 450                 /*
 451                  * 1.5. Otherwise, if the "who" field did not match one
 452                  *      of OWNER@, GROUP@, EVERYONE@:
 453                  *
 454                  * 1.5.1. If the type is ALLOW, check the preceding ACE.
 455                  *        If it does not meet all of the following criteria:
 456                  */
 457                 if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW)
 458                         continue;
 459
 460                 meets = 0;
 461                 if (i > 0) {
 462                         meets = 1;
 463                         previous = &(aclp->acl_entry[i - 1]);
 464
 465                         /*
 466                          * 1.5.1.1. The type field is DENY,
 467                          */
 468                         if (previous->ae_entry_type != ACL_ENTRY_TYPE_DENY)
 469                                 meets = 0;
 470
 471                         /*
 472                          * 1.5.1.2. The "who" field is the same as the current
 473                          *          ACE,
 474                          *
 475                          * 1.5.1.3. The flag bit ACE4_IDENTIFIER_GROUP
 476                          *          is the same as it is in the current ACE,
 477                          *          and no other flag bits are set,
 478                          */
 479                         if (previous->ae_id != entry->ae_id ||
 480                             previous->ae_tag != entry->ae_tag)
 481                                 meets = 0;
 482
 483                         if (previous->ae_flags)
 484                                 meets = 0;
 485
 486                         /*
 487                          * 1.5.1.4. The mask bits are a subset of the mask bits
 488                          *          of the current ACE, and are also subset of
 489                          *          the following: ACL_READ_DATA,
 490                          *          ACL_WRITE_DATA, ACL_APPEND_DATA, ACL_EXECUTE
 491                          */
 492                         if (previous->ae_perm & ~(entry->ae_perm))
 493                                 meets = 0;
 494
 495                         if (previous->ae_perm & ~(ACL_READ_DATA |
 496                             ACL_WRITE_DATA | ACL_APPEND_DATA | ACL_EXECUTE))
 497                                 meets = 0;
 498                 }
 499
 500                 if (!meets) {
 501                         /*
 502                          * Then the ACE of type DENY, with a who equal
 503                          * to the current ACE, flag bits equal to
 504                          * (<current ACE flags> & <ACE_IDENTIFIER_GROUP>)
 505                          * and no mask bits, is prepended.
 506                          */
 507                         previous = entry;
 508                         entry = _acl_duplicate_entry(aclp, i);
 509
 510                         /* Adjust counter, as we've just added an entry. */
 511                         i++;
 512
 513                         previous->ae_tag = entry->ae_tag;
 514                         previous->ae_id = entry->ae_id;
 515                         previous->ae_flags = entry->ae_flags;
 516                         previous->ae_perm = 0;
 517                         previous->ae_entry_type = ACL_ENTRY_TYPE_DENY;
 518                 }
 519
 520                 /*
 521                  * 1.5.2. The following modifications are made to the prepended
 522                  *        ACE.  The intent is to mask the following ACE
 523                  *        to disallow ACL_READ_DATA, ACL_WRITE_DATA,
 524                  *        ACL_APPEND_DATA, or ACL_EXECUTE, based upon the group
 525                  *        permissions of the new mode.  As a special case,
 526                  *        if the ACE matches the current owner of the file,
 527                  *        the owner bits are used, rather than the group bits.
 528                  *        This is reflected in the algorithm below.
 529                  */
 530                 amode = mode >> 3;
 531
 532                 /*
 533                  * If ACE4_IDENTIFIER_GROUP is not set, and the "who" field
 534                  * in ACE matches the owner of the file, we shift amode three
 535                  * more bits, in order to have the owner permission bits
 536                  * placed in the three low order bits of amode.
 537                  */
 538                 if (entry->ae_tag == ACL_USER && entry->ae_id == file_owner_id)
 539                         amode = amode >> 3;
 540
 541                 if (entry->ae_perm & ACL_READ_DATA) {
 542                         if (amode & READ)
 543                                 previous->ae_perm &= ~ACL_READ_DATA;
 544                         else
 545                                 previous->ae_perm |= ACL_READ_DATA;
 546                 }
 547
 548                 if (entry->ae_perm & ACL_WRITE_DATA) {
 549                         if (amode & WRITE)
 550                                 previous->ae_perm &= ~ACL_WRITE_DATA;
 551                         else
 552                                 previous->ae_perm |= ACL_WRITE_DATA;
 553                 }
 554
 555                 if (entry->ae_perm & ACL_APPEND_DATA) {
 556                         if (amode & WRITE)
 557                                 previous->ae_perm &= ~ACL_APPEND_DATA;
 558                         else
 559                                 previous->ae_perm |= ACL_APPEND_DATA;
 560                 }
 561
 562                 if (entry->ae_perm & ACL_EXECUTE) {
 563                         if (amode & EXEC)
 564                                 previous->ae_perm &= ~ACL_EXECUTE;
 565                         else
 566                                 previous->ae_perm |= ACL_EXECUTE;
 567                 }
 568
 569                 /*
 570                  * 1.5.3. If ACE4_IDENTIFIER_GROUP is set in the flags
 571                  *        of the ALLOW ace:
 572                  *
 573                  * XXX: This point is not there in the Falkner's draft.
 574                  */
 575                 if (entry->ae_tag == ACL_GROUP &&
 576                     entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW) {
 577                         mode_t extramode, ownermode;
 578                         extramode = (mode >> 3) & 07;
 579                         ownermode = mode >> 6;
 580                         extramode &= ~ownermode;
 581
 582                         if (extramode) {
 583                                 if (extramode & READ) {
 584                                         entry->ae_perm &= ~ACL_READ_DATA;
 585                                         previous->ae_perm &= ~ACL_READ_DATA;
 586                                 }
 587
 588                                 if (extramode & WRITE) {
 589                                         entry->ae_perm &=
 590                                             ~(ACL_WRITE_DATA | ACL_APPEND_DATA);
 591                                         previous->ae_perm &=
 592                                             ~(ACL_WRITE_DATA | ACL_APPEND_DATA);
 593                                 }
 594
 595                                 if (extramode & EXEC) {
 596                                         entry->ae_perm &= ~ACL_EXECUTE;
 597                                         previous->ae_perm &= ~ACL_EXECUTE;
 598                                 }
 599                         }
 600                 }
 601         }
 602
 603         /*
 604          * 2. If there at least six ACEs, the final six ACEs are examined.
 605          *    If they are not equal to what we want, append six ACEs.
 606          */
 607         must_append = 0;
 608         if (aclp->acl_cnt < 6) {
 609                 must_append = 1;
 610         } else {
 611                 a6 = &(aclp->acl_entry[aclp->acl_cnt - 1]);
 612                 a5 = &(aclp->acl_entry[aclp->acl_cnt - 2]);
 613                 a4 = &(aclp->acl_entry[aclp->acl_cnt - 3]);
 614                 a3 = &(aclp->acl_entry[aclp->acl_cnt - 4]);
 615                 a2 = &(aclp->acl_entry[aclp->acl_cnt - 5]);
 616                 a1 = &(aclp->acl_entry[aclp->acl_cnt - 6]);
 617
 618                 if (!_acl_entry_matches(a1, ACL_USER_OBJ, 0,
 619                     ACL_ENTRY_TYPE_DENY))
 620                         must_append = 1;
 621                 if (!_acl_entry_matches(a2, ACL_USER_OBJ, ACL_WRITE_ACL |
 622                     ACL_WRITE_OWNER | ACL_WRITE_ATTRIBUTES |
 623                     ACL_WRITE_NAMED_ATTRS, ACL_ENTRY_TYPE_ALLOW))
 624                         must_append = 1;
 625                 if (!_acl_entry_matches(a3, ACL_GROUP_OBJ, 0,
 626                     ACL_ENTRY_TYPE_DENY))
 627                         must_append = 1;
 628                 if (!_acl_entry_matches(a4, ACL_GROUP_OBJ, 0,
 629                     ACL_ENTRY_TYPE_ALLOW))
 630                         must_append = 1;
 631                 if (!_acl_entry_matches(a5, ACL_EVERYONE, ACL_WRITE_ACL |
 632                     ACL_WRITE_OWNER | ACL_WRITE_ATTRIBUTES |
 633                     ACL_WRITE_NAMED_ATTRS, ACL_ENTRY_TYPE_DENY))
 634                         must_append = 1;
 635                 if (!_acl_entry_matches(a6, ACL_EVERYONE, ACL_READ_ACL |
 636                     ACL_READ_ATTRIBUTES | ACL_READ_NAMED_ATTRS |
 637                     ACL_SYNCHRONIZE, ACL_ENTRY_TYPE_ALLOW))
 638                         must_append = 1;
 639         }
 640
 641         if (must_append) {
 642                 KASSERT(aclp->acl_cnt + 6 <= ACL_MAX_ENTRIES,
 643                     ("aclp->acl_cnt <= ACL_MAX_ENTRIES"));
 644
 645                 a1 = _acl_append(aclp, ACL_USER_OBJ, 0, ACL_ENTRY_TYPE_DENY);
 646                 a2 = _acl_append(aclp, ACL_USER_OBJ, ACL_WRITE_ACL |
 647                     ACL_WRITE_OWNER | ACL_WRITE_ATTRIBUTES |
 648                     ACL_WRITE_NAMED_ATTRS, ACL_ENTRY_TYPE_ALLOW);
 649                 a3 = _acl_append(aclp, ACL_GROUP_OBJ, 0, ACL_ENTRY_TYPE_DENY);
 650                 a4 = _acl_append(aclp, ACL_GROUP_OBJ, 0, ACL_ENTRY_TYPE_ALLOW);
 651                 a5 = _acl_append(aclp, ACL_EVERYONE, ACL_WRITE_ACL |
 652                     ACL_WRITE_OWNER | ACL_WRITE_ATTRIBUTES |
 653                     ACL_WRITE_NAMED_ATTRS, ACL_ENTRY_TYPE_DENY);
 654                 a6 = _acl_append(aclp, ACL_EVERYONE, ACL_READ_ACL |
 655                     ACL_READ_ATTRIBUTES | ACL_READ_NAMED_ATTRS |
 656                     ACL_SYNCHRONIZE, ACL_ENTRY_TYPE_ALLOW);
 657
 658                 KASSERT(a1 != NULL && a2 != NULL && a3 != NULL && a4 != NULL &&
 659                     a5 != NULL && a6 != NULL, ("couldn't append to ACL."));
 660         }
 661
 662         /*
 663          * 3. The final six ACEs are adjusted according to the incoming mode.
 664          */
 665         if (mode & S_IRUSR)
 666                 a2->ae_perm |= ACL_READ_DATA;
 667         else
 668                 a1->ae_perm |= ACL_READ_DATA;
 669         if (mode & S_IWUSR)
 670                 a2->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
 671         else
 672                 a1->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
 673         if (mode & S_IXUSR)
 674                 a2->ae_perm |= ACL_EXECUTE;
 675         else
 676                 a1->ae_perm |= ACL_EXECUTE;
 677
 678         if (mode & S_IRGRP)
 679                 a4->ae_perm |= ACL_READ_DATA;
 680         else
 681                 a3->ae_perm |= ACL_READ_DATA;
 682         if (mode & S_IWGRP)
 683                 a4->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
 684         else
 685                 a3->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
 686         if (mode & S_IXGRP)
 687                 a4->ae_perm |= ACL_EXECUTE;
 688         else
 689                 a3->ae_perm |= ACL_EXECUTE;
 690
 691         if (mode & S_IROTH)
 692                 a6->ae_perm |= ACL_READ_DATA;
 693         else
 694                 a5->ae_perm |= ACL_READ_DATA;
 695         if (mode & S_IWOTH)
 696                 a6->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
 697         else
 698                 a5->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
 699         if (mode & S_IXOTH)
 700                 a6->ae_perm |= ACL_EXECUTE;
 701         else
 702                 a5->ae_perm |= ACL_EXECUTE;
 703 }
 704
 705 #ifdef _KERNEL
 706 void
 707 acl_nfs4_sync_acl_from_mode(struct acl *aclp, mode_t mode,
 708     int file_owner_id)
 709 {
 710
 711         if (acl_nfs4_old_semantics)
 712                 acl_nfs4_sync_acl_from_mode_draft(aclp, mode, file_owner_id);
 713         else
 714                 acl_nfs4_trivial_from_mode(aclp, mode);
 715 }
 716 #endif /* _KERNEL */
 717
 718 void
 719 acl_nfs4_sync_mode_from_acl(mode_t *_mode, const struct acl *aclp)
 720 {
 721         int i;
 722         mode_t old_mode = *_mode, mode = 0, seen = 0;
 723         const struct acl_entry *entry;
 724
 725         KASSERT(aclp->acl_cnt <= ACL_MAX_ENTRIES,
 726             ("aclp->acl_cnt <= ACL_MAX_ENTRIES"));
 727
 728         /*
 729          * NFSv4 Minor Version 1, draft-ietf-nfsv4-minorversion1-03.txt
 730          *
 731          * 3.16.6.1. Recomputing mode upon SETATTR of ACL
 732          */
 733
 734         for (i = 0; i < aclp->acl_cnt; i++) {
 735                 entry = &(aclp->acl_entry[i]);
 736
 737                 if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW &&
 738                     entry->ae_entry_type != ACL_ENTRY_TYPE_DENY)
 739                         continue;
 740
 741                 if (entry->ae_flags & ACL_ENTRY_INHERIT_ONLY)
 742                         continue;
 743
 744                 if (entry->ae_tag == ACL_USER_OBJ) {
 745                         if ((entry->ae_perm & ACL_READ_DATA) &&
 746                             ((seen & S_IRUSR) == 0)) {
 747                                 seen |= S_IRUSR;
 748                                 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 749                                         mode |= S_IRUSR;
 750                         }
 751                         if ((entry->ae_perm & ACL_WRITE_DATA) &&
 752                              ((seen & S_IWUSR) == 0)) {
 753                                 seen |= S_IWUSR;
 754                                 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 755                                         mode |= S_IWUSR;
 756                         }
 757                         if ((entry->ae_perm & ACL_EXECUTE) &&
 758                             ((seen & S_IXUSR) == 0)) {
 759                                 seen |= S_IXUSR;
 760                                 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 761                                         mode |= S_IXUSR;
 762                         }
 763                 } else if (entry->ae_tag == ACL_GROUP_OBJ) {
 764                         if ((entry->ae_perm & ACL_READ_DATA) &&
 765                             ((seen & S_IRGRP) == 0)) {
 766                                 seen |= S_IRGRP;
 767                                 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 768                                         mode |= S_IRGRP;
 769                         }
 770                         if ((entry->ae_perm & ACL_WRITE_DATA) &&
 771                             ((seen & S_IWGRP) == 0)) {
 772                                 seen |= S_IWGRP;
 773                                 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 774                                         mode |= S_IWGRP;
 775                         }
 776                         if ((entry->ae_perm & ACL_EXECUTE) &&
 777                             ((seen & S_IXGRP) == 0)) {
 778                                 seen |= S_IXGRP;
 779                                 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 780                                         mode |= S_IXGRP;
 781                         }
 782                 } else if (entry->ae_tag == ACL_EVERYONE) {
 783                         if (entry->ae_perm & ACL_READ_DATA) {
 784                                 if ((seen & S_IRUSR) == 0) {
 785                                         seen |= S_IRUSR;
 786                                         if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 787                                                 mode |= S_IRUSR;
 788                                 }
 789                                 if ((seen & S_IRGRP) == 0) {
 790                                         seen |= S_IRGRP;
 791                                         if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 792                                                 mode |= S_IRGRP;
 793                                 }
 794                                 if ((seen & S_IROTH) == 0) {
 795                                         seen |= S_IROTH;
 796                                         if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 797                                                 mode |= S_IROTH;
 798                                 }
 799                         }
 800                         if (entry->ae_perm & ACL_WRITE_DATA) {
 801                                 if ((seen & S_IWUSR) == 0) {
 802                                         seen |= S_IWUSR;
 803                                         if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 804                                                 mode |= S_IWUSR;
 805                                 }
 806                                 if ((seen & S_IWGRP) == 0) {
 807                                         seen |= S_IWGRP;
 808                                         if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 809                                                 mode |= S_IWGRP;
 810                                 }
 811                                 if ((seen & S_IWOTH) == 0) {
 812                                         seen |= S_IWOTH;
 813                                         if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 814                                                 mode |= S_IWOTH;
 815                                 }
 816                         }
 817                         if (entry->ae_perm & ACL_EXECUTE) {
 818                                 if ((seen & S_IXUSR) == 0) {
 819                                         seen |= S_IXUSR;
 820                                         if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 821                                                 mode |= S_IXUSR;
 822                                 }
 823                                 if ((seen & S_IXGRP) == 0) {
 824                                         seen |= S_IXGRP;
 825                                         if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 826                                                 mode |= S_IXGRP;
 827                                 }
 828                                 if ((seen & S_IXOTH) == 0) {
 829                                         seen |= S_IXOTH;
 830                                         if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 831                                                 mode |= S_IXOTH;
 832                                 }
 833                         }
 834                 }
 835         }
 836
 837         *_mode = mode | (old_mode & ACL_PRESERVE_MASK);
 838 }
 839
 840 #ifdef _KERNEL
 841 /*
 842  * Calculate inherited ACL in a manner compatible with NFSv4 Minor Version 1,
 843  * draft-ietf-nfsv4-minorversion1-03.txt.
 844  */
 845 static void
 846 acl_nfs4_compute_inherited_acl_draft(const struct acl *parent_aclp,
 847     struct acl *child_aclp, mode_t mode, int file_owner_id,
 848     int is_directory)
 849 {
 850         int i, flags;
 851         const struct acl_entry *parent_entry;
 852         struct acl_entry *entry, *copy;
 853
 854         KASSERT(child_aclp->acl_cnt == 0, ("child_aclp->acl_cnt == 0"));
 855         KASSERT(parent_aclp->acl_cnt <= ACL_MAX_ENTRIES,
 856             ("parent_aclp->acl_cnt <= ACL_MAX_ENTRIES"));
 857
 858         /*
 859          * NFSv4 Minor Version 1, draft-ietf-nfsv4-minorversion1-03.txt
 860          *
 861          * 3.16.6.2. Applying the mode given to CREATE or OPEN
 862          *           to an inherited ACL
 863          */
 864
 865         /*
 866          * 1. Form an ACL that is the concatenation of all inheritable ACEs.
 867          */
 868         for (i = 0; i < parent_aclp->acl_cnt; i++) {
 869                 parent_entry = &(parent_aclp->acl_entry[i]);
 870                 flags = parent_entry->ae_flags;
 871
 872                 /*
 873                  * Entry is not inheritable at all.
 874                  */
 875                 if ((flags & (ACL_ENTRY_DIRECTORY_INHERIT |
 876                     ACL_ENTRY_FILE_INHERIT)) == 0)
 877                         continue;
 878
 879                 /*
 880                  * We're creating a file, but entry is not inheritable
 881                  * by files.
 882                  */
 883                 if (!is_directory && (flags & ACL_ENTRY_FILE_INHERIT) == 0)
 884                         continue;
 885
 886                 /*
 887                  * Entry is inheritable only by files, but has NO_PROPAGATE
 888                  * flag set, and we're creating a directory, so it wouldn't
 889                  * propagate to any file in that directory anyway.
 890                  */
 891                 if (is_directory &&
 892                     (flags & ACL_ENTRY_DIRECTORY_INHERIT) == 0 &&
 893                     (flags & ACL_ENTRY_NO_PROPAGATE_INHERIT))
 894                         continue;
 895
 896                 KASSERT(child_aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES,
 897                     ("child_aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES"));
 898                 child_aclp->acl_entry[child_aclp->acl_cnt] = *parent_entry;
 899                 child_aclp->acl_cnt++;
 900         }
 901
 902         /*
 903          * 2. For each entry in the new ACL, adjust its flags, possibly
 904          *    creating two entries in place of one.
 905          */
 906         for (i = 0; i < child_aclp->acl_cnt; i++) {
 907                 entry = &(child_aclp->acl_entry[i]);
 908
 909                 /*
 910                  * This is not in the specification, but SunOS
 911                  * apparently does that.
 912                  */
 913                 if (((entry->ae_flags & ACL_ENTRY_NO_PROPAGATE_INHERIT) ||
 914                     !is_directory) &&
 915                     entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 916                         entry->ae_perm &= ~(ACL_WRITE_ACL | ACL_WRITE_OWNER);
 917
 918                 /*
 919                  * 2.A. If the ACL_ENTRY_NO_PROPAGATE_INHERIT is set, or if the object
 920                  *      being created is not a directory, then clear the
 921                  *      following flags: ACL_ENTRY_NO_PROPAGATE_INHERIT,
 922                  *      ACL_ENTRY_FILE_INHERIT, ACL_ENTRY_DIRECTORY_INHERIT,
 923                  *      ACL_ENTRY_INHERIT_ONLY.
 924                  */
 925                 if (entry->ae_flags & ACL_ENTRY_NO_PROPAGATE_INHERIT ||
 926                     !is_directory) {
 927                         entry->ae_flags &= ~(ACL_ENTRY_NO_PROPAGATE_INHERIT |
 928                         ACL_ENTRY_FILE_INHERIT | ACL_ENTRY_DIRECTORY_INHERIT |
 929                         ACL_ENTRY_INHERIT_ONLY);
 930
 931                         /*
 932                          * Continue on to the next ACE.
 933                          */
 934                         continue;
 935                 }
 936
 937                 /*
 938                  * 2.B. If the object is a directory and ACL_ENTRY_FILE_INHERIT
 939                  *      is set, but ACL_ENTRY_NO_PROPAGATE_INHERIT is not set, ensure
 940                  *      that ACL_ENTRY_INHERIT_ONLY is set.  Continue to the
 941                  *      next ACE.  Otherwise...
 942                  */
 943                 /*
 944                  * XXX: Read it again and make sure what does the "otherwise"
 945                  *      apply to.
 946                  */
 947                 if (is_directory &&
 948                     (entry->ae_flags & ACL_ENTRY_FILE_INHERIT) &&
 949                     ((entry->ae_flags & ACL_ENTRY_DIRECTORY_INHERIT) == 0)) {
 950                         entry->ae_flags |= ACL_ENTRY_INHERIT_ONLY;
 951                         continue;
 952                 }
 953
 954                 /*
 955                  * 2.C. If the type of the ACE is neither ALLOW nor deny,
 956                  *      then continue.
 957                  */
 958                 if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW &&
 959                     entry->ae_entry_type != ACL_ENTRY_TYPE_DENY)
 960                         continue;
 961
 962                 /*
 963                  * 2.D. Copy the original ACE into a second, adjacent ACE.
 964                  */
 965                 copy = _acl_duplicate_entry(child_aclp, i);
 966
 967                 /*
 968                  * 2.E. On the first ACE, ensure that ACL_ENTRY_INHERIT_ONLY
 969                  *      is set.
 970                  */
 971                 entry->ae_flags |= ACL_ENTRY_INHERIT_ONLY;
 972
 973                 /*
 974                  * 2.F. On the second ACE, clear the following flags:
 975                  *      ACL_ENTRY_NO_PROPAGATE_INHERIT, ACL_ENTRY_FILE_INHERIT,
 976                  *      ACL_ENTRY_DIRECTORY_INHERIT, ACL_ENTRY_INHERIT_ONLY.
 977                  */
 978                 copy->ae_flags &= ~(ACL_ENTRY_NO_PROPAGATE_INHERIT |
 979                     ACL_ENTRY_FILE_INHERIT | ACL_ENTRY_DIRECTORY_INHERIT |
 980                     ACL_ENTRY_INHERIT_ONLY);
 981
 982                 /*
 983                  * 2.G. On the second ACE, if the type is ALLOW,
 984                  *      an implementation MAY clear the following
 985                  *      mask bits: ACL_WRITE_ACL, ACL_WRITE_OWNER.
 986                  */
 987                 if (copy->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 988                         copy->ae_perm &= ~(ACL_WRITE_ACL | ACL_WRITE_OWNER);
 989
 990                 /*
 991                  * Increment the counter to skip the copied entry.
 992                  */
 993                 i++;
 994         }
 995
 996         /*
 997          * 3. To ensure that the mode is honored, apply the algorithm describe
 998          *    in Section 2.16.6.3, using the mode that is to be used for file
 999          *    creation.
1000          */
1001         acl_nfs4_sync_acl_from_mode(child_aclp, mode, file_owner_id);
1002 }
1003 #endif /* _KERNEL */
1004
1005 /*
1006  * Populate the ACL with entries inherited from parent_aclp.
1007  */
1008 static void
1009 acl_nfs4_inherit_entries(const struct acl *parent_aclp,
1010     struct acl *child_aclp, mode_t mode, int file_owner_id,
1011     int is_directory)
1012 {
1013         int i, flags, tag;
1014         const struct acl_entry *parent_entry;
1015         struct acl_entry *entry;
1016
1017         KASSERT(parent_aclp->acl_cnt <= ACL_MAX_ENTRIES,
1018             ("parent_aclp->acl_cnt <= ACL_MAX_ENTRIES"));
1019
1020         for (i = 0; i < parent_aclp->acl_cnt; i++) {
1021                 parent_entry = &(parent_aclp->acl_entry[i]);
1022                 flags = parent_entry->ae_flags;
1023                 tag = parent_entry->ae_tag;
1024
1025                 /*
1026                  * Don't inherit owner@, group@, or everyone@ entries.
1027                  */
1028                 if (tag == ACL_USER_OBJ || tag == ACL_GROUP_OBJ ||
1029                     tag == ACL_EVERYONE)
1030                         continue;
1031
1032                 /*
1033                  * Entry is not inheritable at all.
1034                  */
1035                 if ((flags & (ACL_ENTRY_DIRECTORY_INHERIT |
1036                     ACL_ENTRY_FILE_INHERIT)) == 0)
1037                         continue;
1038
1039                 /*
1040                  * We're creating a file, but entry is not inheritable
1041                  * by files.
1042                  */
1043                 if (!is_directory && (flags & ACL_ENTRY_FILE_INHERIT) == 0)
1044                         continue;
1045
1046                 /*
1047                  * Entry is inheritable only by files, but has NO_PROPAGATE
1048                  * flag set, and we're creating a directory, so it wouldn't
1049                  * propagate to any file in that directory anyway.
1050                  */
1051                 if (is_directory &&
1052                     (flags & ACL_ENTRY_DIRECTORY_INHERIT) == 0 &&
1053                     (flags & ACL_ENTRY_NO_PROPAGATE_INHERIT))
1054                         continue;
1055
1056                 /*
1057                  * Entry qualifies for being inherited.
1058                  */
1059                 KASSERT(child_aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES,
1060                     ("child_aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES"));
1061                 entry = &(child_aclp->acl_entry[child_aclp->acl_cnt]);
1062                 *entry = *parent_entry;
1063                 child_aclp->acl_cnt++;
1064
1065                 entry->ae_flags &= ~ACL_ENTRY_INHERIT_ONLY;
1066
1067                 /*
1068                  * If the type of the ACE is neither ALLOW nor DENY,
1069                  * then leave it as it is and proceed to the next one.
1070                  */
1071                 if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW &&
1072                     entry->ae_entry_type != ACL_ENTRY_TYPE_DENY)
1073                         continue;
1074
1075                 /*
1076                  * If the ACL_ENTRY_NO_PROPAGATE_INHERIT is set, or if
1077                  * the object being created is not a directory, then clear
1078                  * the following flags: ACL_ENTRY_NO_PROPAGATE_INHERIT,
1079                  * ACL_ENTRY_FILE_INHERIT, ACL_ENTRY_DIRECTORY_INHERIT,
1080                  * ACL_ENTRY_INHERIT_ONLY.
1081                  */
1082                 if (entry->ae_flags & ACL_ENTRY_NO_PROPAGATE_INHERIT ||
1083                     !is_directory) {
1084                         entry->ae_flags &= ~(ACL_ENTRY_NO_PROPAGATE_INHERIT |
1085                         ACL_ENTRY_FILE_INHERIT | ACL_ENTRY_DIRECTORY_INHERIT |
1086                         ACL_ENTRY_INHERIT_ONLY);
1087                 }
1088
1089                 /*
1090                  * If the object is a directory and ACL_ENTRY_FILE_INHERIT
1091                  * is set, but ACL_ENTRY_DIRECTORY_INHERIT is not set, ensure
1092                  * that ACL_ENTRY_INHERIT_ONLY is set.
1093                  */
1094                 if (is_directory &&
1095                     (entry->ae_flags & ACL_ENTRY_FILE_INHERIT) &&
1096                     ((entry->ae_flags & ACL_ENTRY_DIRECTORY_INHERIT) == 0)) {
1097                         entry->ae_flags |= ACL_ENTRY_INHERIT_ONLY;
1098                 }
1099
1100                 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW &&
1101                     (entry->ae_flags & ACL_ENTRY_INHERIT_ONLY) == 0) {
1102                         /*
1103                          * Some permissions must never be inherited.
1104                          */
1105                         entry->ae_perm &= ~(ACL_WRITE_ACL | ACL_WRITE_OWNER |
1106                             ACL_WRITE_NAMED_ATTRS | ACL_WRITE_ATTRIBUTES);
1107
1108                         /*
1109                          * Others must be masked according to the file mode.
1110                          */
1111                         if ((mode & S_IRGRP) == 0)
1112                                 entry->ae_perm &= ~ACL_READ_DATA;
1113                         if ((mode & S_IWGRP) == 0)
1114                                 entry->ae_perm &=
1115                                     ~(ACL_WRITE_DATA | ACL_APPEND_DATA);
1116                         if ((mode & S_IXGRP) == 0)
1117                                 entry->ae_perm &= ~ACL_EXECUTE;
1118                 }
1119         }
1120 }
1121
1122 /*
1123  * Calculate inherited ACL in a manner compatible with PSARC/2010/029.
1124  * It's also being used to calculate a trivial ACL, by inheriting from
1125  * a NULL ACL.
1126  */
1127 static void
1128 acl_nfs4_compute_inherited_acl_psarc(const struct acl *parent_aclp,
1129     struct acl *aclp, mode_t mode, int file_owner_id, int is_directory)
1130 {
1131         acl_perm_t user_allow_first = 0, user_deny = 0, group_deny = 0;
1132         acl_perm_t user_allow, group_allow, everyone_allow;
1133
1134         KASSERT(aclp->acl_cnt == 0, ("aclp->acl_cnt == 0"));
1135
1136         user_allow = group_allow = everyone_allow = ACL_READ_ACL |
1137             ACL_READ_ATTRIBUTES | ACL_READ_NAMED_ATTRS | ACL_SYNCHRONIZE;
1138         user_allow |= ACL_WRITE_ACL | ACL_WRITE_OWNER | ACL_WRITE_ATTRIBUTES |
1139             ACL_WRITE_NAMED_ATTRS;
1140
1141         if (mode & S_IRUSR)
1142                 user_allow |= ACL_READ_DATA;
1143         if (mode & S_IWUSR)
1144                 user_allow |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
1145         if (mode & S_IXUSR)
1146                 user_allow |= ACL_EXECUTE;
1147
1148         if (mode & S_IRGRP)
1149                 group_allow |= ACL_READ_DATA;
1150         if (mode & S_IWGRP)
1151                 group_allow |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
1152         if (mode & S_IXGRP)
1153                 group_allow |= ACL_EXECUTE;
1154
1155         if (mode & S_IROTH)
1156                 everyone_allow |= ACL_READ_DATA;
1157         if (mode & S_IWOTH)
1158                 everyone_allow |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
1159         if (mode & S_IXOTH)
1160                 everyone_allow |= ACL_EXECUTE;
1161
1162         user_deny = ((group_allow | everyone_allow) & ~user_allow);
1163         group_deny = everyone_allow & ~group_allow;
1164         user_allow_first = group_deny & ~user_deny;
1165
1166         if (user_allow_first != 0)
1167                 _acl_append(aclp, ACL_USER_OBJ, user_allow_first,
1168                     ACL_ENTRY_TYPE_ALLOW);
1169         if (user_deny != 0)
1170                 _acl_append(aclp, ACL_USER_OBJ, user_deny,
1171                     ACL_ENTRY_TYPE_DENY);
1172         if (group_deny != 0)
1173                 _acl_append(aclp, ACL_GROUP_OBJ, group_deny,
1174                     ACL_ENTRY_TYPE_DENY);
1175
1176         if (parent_aclp != NULL)
1177                 acl_nfs4_inherit_entries(parent_aclp, aclp, mode,
1178                     file_owner_id, is_directory);
1179
1180         _acl_append(aclp, ACL_USER_OBJ, user_allow, ACL_ENTRY_TYPE_ALLOW);
1181         _acl_append(aclp, ACL_GROUP_OBJ, group_allow, ACL_ENTRY_TYPE_ALLOW);
1182         _acl_append(aclp, ACL_EVERYONE, everyone_allow, ACL_ENTRY_TYPE_ALLOW);
1183 }
1184
1185 #ifdef _KERNEL
1186 void
1187 acl_nfs4_compute_inherited_acl(const struct acl *parent_aclp,
1188     struct acl *child_aclp, mode_t mode, int file_owner_id,
1189     int is_directory)
1190 {
1191
1192         if (acl_nfs4_old_semantics)
1193                 acl_nfs4_compute_inherited_acl_draft(parent_aclp, child_aclp,
1194                     mode, file_owner_id, is_directory);
1195         else
1196                 acl_nfs4_compute_inherited_acl_psarc(parent_aclp, child_aclp,
1197                     mode, file_owner_id, is_directory);
1198 }
1199 #endif /* _KERNEL */
1200
1201 /*
1202  * Calculate trivial ACL in a manner compatible with PSARC/2010/029.
1203  * Note that this results in an ACL different from (but semantically
1204  * equal to) the "canonical six" trivial ACL computed using algorithm
1205  * described in draft-ietf-nfsv4-minorversion1-03.txt, 3.16.6.2.
1206  */
1207 static void
1208 acl_nfs4_trivial_from_mode(struct acl *aclp, mode_t mode)
1209 {
1210
1211         aclp->acl_cnt = 0;
1212         acl_nfs4_compute_inherited_acl_psarc(NULL, aclp, mode, -1, -1);
1213 }
1214
1215 #ifndef _KERNEL
1216 /*
1217  * This routine is used by libc to implement acl_strip_np(3)
1218  * and acl_is_trivial_np(3).
1219  */
1220 void
1221 acl_nfs4_trivial_from_mode_libc(struct acl *aclp, int mode, int canonical_six)
1222 {
1223
1224         aclp->acl_cnt = 0;
1225         if (canonical_six)
1226                 acl_nfs4_sync_acl_from_mode_draft(aclp, mode, -1);
1227         else
1228                 acl_nfs4_trivial_from_mode(aclp, mode);
1229 }
1230 #endif /* !_KERNEL */
1231
1232 #ifdef _KERNEL
1233 static int
1234 _acls_are_equal(const struct acl *a, const struct acl *b)
1235 {
1236         int i;
1237         const struct acl_entry *entrya, *entryb;
1238
1239         if (a->acl_cnt != b->acl_cnt)
1240                 return (0);
1241
1242         for (i = 0; i < b->acl_cnt; i++) {
1243                 entrya = &(a->acl_entry[i]);
1244                 entryb = &(b->acl_entry[i]);
1245
1246                 if (entrya->ae_tag != entryb->ae_tag ||
1247                     entrya->ae_id != entryb->ae_id ||
1248                     entrya->ae_perm != entryb->ae_perm ||
1249                     entrya->ae_entry_type != entryb->ae_entry_type ||
1250                     entrya->ae_flags != entryb->ae_flags)
1251                         return (0);
1252         }
1253
1254         return (1);
1255 }
1256
1257 /*
1258  * This routine is used to determine whether to remove extended attribute
1259  * that stores ACL contents.
1260  */
1261 int
1262 acl_nfs4_is_trivial(const struct acl *aclp, int file_owner_id)
1263 {
1264         int trivial;
1265         mode_t tmpmode = 0;
1266         struct acl *tmpaclp;
1267
1268         if (aclp->acl_cnt > 6)
1269                 return (0);
1270
1271         /*
1272          * Compute the mode from the ACL, then compute new ACL from that mode.
1273          * If the ACLs are identical, then the ACL is trivial.
1274          *
1275          * XXX: I guess there is a faster way to do this.  However, even
1276          *      this slow implementation significantly speeds things up
1277          *      for files that don't have non-trivial ACLs - it's critical
1278          *      for performance to not use EA when they are not needed.
1279          *
1280          * First try the PSARC/2010/029 semantics.
1281          */
1282         tmpaclp = acl_alloc(M_WAITOK | M_ZERO);
1283         acl_nfs4_sync_mode_from_acl(&tmpmode, aclp);
1284         acl_nfs4_trivial_from_mode(tmpaclp, tmpmode);
1285         trivial = _acls_are_equal(aclp, tmpaclp);
1286         if (trivial) {
1287                 acl_free(tmpaclp);
1288                 return (trivial);
1289         }
1290
1291         /*
1292          * Check if it's a draft-ietf-nfsv4-minorversion1-03.txt trivial ACL.
1293          */
1294         tmpaclp->acl_cnt = 0;
1295         acl_nfs4_sync_acl_from_mode_draft(tmpaclp, tmpmode, file_owner_id);
1296         trivial = _acls_are_equal(aclp, tmpaclp);
1297         acl_free(tmpaclp);
1298
1299         return (trivial);
1300 }
1301 #endif /* _KERNEL */
1302
1303 int
1304 acl_nfs4_check(const struct acl *aclp, int is_directory)
1305 {
1306         int i;
1307         const struct acl_entry *entry;
1308
1309         /*
1310          * The spec doesn't seem to say anything about ACL validity.
1311          * It seems there is not much to do here.  There is even no need
1312          * to count "owner@" or "everyone@" (ACL_USER_OBJ and ACL_EVERYONE)
1313          * entries, as there can be several of them and that's perfectly
1314          * valid.  There can be none of them too.  Really.
1315          */
1316
1317         if (aclp->acl_cnt > ACL_MAX_ENTRIES || aclp->acl_cnt <= 0)
1318                 return (EINVAL);
1319
1320         for (i = 0; i < aclp->acl_cnt; i++) {
1321                 entry = &(aclp->acl_entry[i]);
1322
1323                 switch (entry->ae_tag) {
1324                 case ACL_USER_OBJ:
1325                 case ACL_GROUP_OBJ:
1326                 case ACL_EVERYONE:
1327                         if (entry->ae_id != ACL_UNDEFINED_ID)
1328                                 return (EINVAL);
1329                         break;
1330
1331                 case ACL_USER:
1332                 case ACL_GROUP:
1333                         if (entry->ae_id == ACL_UNDEFINED_ID)
1334                                 return (EINVAL);
1335                         break;
1336
1337                 default:
1338                         return (EINVAL);
1339                 }
1340
1341                 if ((entry->ae_perm | ACL_NFS4_PERM_BITS) != ACL_NFS4_PERM_BITS)
1342                         return (EINVAL);
1343
1344                 /*
1345                  * Disallow ACL_ENTRY_TYPE_AUDIT and ACL_ENTRY_TYPE_ALARM for now.
1346                  */
1347                 if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW &&
1348                     entry->ae_entry_type != ACL_ENTRY_TYPE_DENY)
1349                         return (EINVAL);
1350
1351                 if ((entry->ae_flags | ACL_FLAGS_BITS) != ACL_FLAGS_BITS)
1352                         return (EINVAL);
1353
1354                 /* Disallow unimplemented flags. */
1355                 if (entry->ae_flags & (ACL_ENTRY_SUCCESSFUL_ACCESS |
1356                     ACL_ENTRY_FAILED_ACCESS))
1357                         return (EINVAL);
1358
1359                 /* Disallow flags not allowed for ordinary files. */
1360                 if (!is_directory) {
1361                         if (entry->ae_flags & (ACL_ENTRY_FILE_INHERIT |
1362                             ACL_ENTRY_DIRECTORY_INHERIT |
1363                             ACL_ENTRY_NO_PROPAGATE_INHERIT | ACL_ENTRY_INHERIT_ONLY))
1364                                 return (EINVAL);
1365                 }
1366         }
1367
1368         return (0);
1369 }