sys/kern/subr_acl_nfs4.c

   1 /*-
   2  * Copyright (c) 2008-2010 Edward Tomasz Napierała <trasz@FreeBSD.org>
   3  * All rights reserved.
   4  *
   5  * Redistribution and use in source and binary forms, with or without
   6  * modification, are permitted provided that the following conditions
   7  * are met:
   8  * 1. Redistributions of source code must retain the above copyright
   9  *    notice, this list of conditions and the following disclaimer.
  10  * 2. Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in the
  12  *    documentation and/or other materials provided with the distribution.
  13  *
  14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
  15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
  18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  24  * SUCH DAMAGE.
  25  */
  26
  27 /*
  28  * ACL support routines specific to NFSv4 access control lists.  These are
  29  * utility routines for code common across file systems implementing NFSv4
  30  * ACLs.
  31  */
  32
  33 #ifdef _KERNEL
  34 #include <sys/cdefs.h>
  35 __FBSDID("$FreeBSD$");
  36
  37 #include <sys/param.h>
  38 #include <sys/systm.h>
  39 #include <sys/mount.h>
  40 #include <sys/priv.h>
  41 #include <sys/vnode.h>
  42 #include <sys/errno.h>
  43 #include <sys/stat.h>
  44 #include <sys/sysctl.h>
  45 #include <sys/acl.h>
  46 #else
  47 #include <errno.h>
  48 #include <assert.h>
  49 #include <sys/acl.h>
  50 #include <sys/stat.h>
  51 #define KASSERT(a, b) assert(a)
  52 #define CTASSERT(a)
  53
  54 #endif /* !_KERNEL */
  55
  56 #ifdef _KERNEL
  57
  58 static void     acl_nfs4_trivial_from_mode(struct acl *aclp, mode_t mode);
  59
  60 static int      acl_nfs4_old_semantics = 0;
  61
  62 SYSCTL_INT(_vfs, OID_AUTO, acl_nfs4_old_semantics, CTLFLAG_RW,
  63     &acl_nfs4_old_semantics, 0, "Use pre-PSARC/2010/029 NFSv4 ACL semantics");
  64
  65 static struct {
  66         accmode_t accmode;
  67         int mask;
  68 } accmode2mask[] = {{VREAD, ACL_READ_DATA},
  69                     {VWRITE, ACL_WRITE_DATA},
  70                     {VAPPEND, ACL_APPEND_DATA},
  71                     {VEXEC, ACL_EXECUTE},
  72                     {VREAD_NAMED_ATTRS, ACL_READ_NAMED_ATTRS},
  73                     {VWRITE_NAMED_ATTRS, ACL_WRITE_NAMED_ATTRS},
  74                     {VDELETE_CHILD, ACL_DELETE_CHILD},
  75                     {VREAD_ATTRIBUTES, ACL_READ_ATTRIBUTES},
  76                     {VWRITE_ATTRIBUTES, ACL_WRITE_ATTRIBUTES},
  77                     {VDELETE, ACL_DELETE},
  78                     {VREAD_ACL, ACL_READ_ACL},
  79                     {VWRITE_ACL, ACL_WRITE_ACL},
  80                     {VWRITE_OWNER, ACL_WRITE_OWNER},
  81                     {VSYNCHRONIZE, ACL_SYNCHRONIZE},
  82                     {0, 0}};
  83
  84 static int
  85 _access_mask_from_accmode(accmode_t accmode)
  86 {
  87         int access_mask = 0, i;
  88
  89         for (i = 0; accmode2mask[i].accmode != 0; i++) {
  90                 if (accmode & accmode2mask[i].accmode)
  91                         access_mask |= accmode2mask[i].mask;
  92         }
  93
  94         /*
  95          * VAPPEND is just a modifier for VWRITE; if the caller asked
  96          * for 'VAPPEND | VWRITE', we want to check for ACL_APPEND_DATA only.
  97          */
  98         if (access_mask & ACL_APPEND_DATA)
  99                 access_mask &= ~ACL_WRITE_DATA;
 100
 101         return (access_mask);
 102 }
 103
 104 /*
 105  * Return 0, iff access is allowed, 1 otherwise.
 106  */
 107 static int
 108 _acl_denies(const struct acl *aclp, int access_mask, struct ucred *cred,
 109     int file_uid, int file_gid, int *denied_explicitly)
 110 {
 111         int i;
 112         const struct acl_entry *entry;
 113
 114         if (denied_explicitly != NULL)
 115                 *denied_explicitly = 0;
 116
 117         KASSERT(aclp->acl_cnt > 0, ("aclp->acl_cnt > 0"));
 118         KASSERT(aclp->acl_cnt <= ACL_MAX_ENTRIES,
 119             ("aclp->acl_cnt <= ACL_MAX_ENTRIES"));
 120
 121         for (i = 0; i < aclp->acl_cnt; i++) {
 122                 entry = &(aclp->acl_entry[i]);
 123
 124                 if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW &&
 125                     entry->ae_entry_type != ACL_ENTRY_TYPE_DENY)
 126                         continue;
 127                 if (entry->ae_flags & ACL_ENTRY_INHERIT_ONLY)
 128                         continue;
 129                 switch (entry->ae_tag) {
 130                 case ACL_USER_OBJ:
 131                         if (file_uid != cred->cr_uid)
 132                                 continue;
 133                         break;
 134                 case ACL_USER:
 135                         if (entry->ae_id != cred->cr_uid)
 136                                 continue;
 137                         break;
 138                 case ACL_GROUP_OBJ:
 139                         if (!groupmember(file_gid, cred))
 140                                 continue;
 141                         break;
 142                 case ACL_GROUP:
 143                         if (!groupmember(entry->ae_id, cred))
 144                                 continue;
 145                         break;
 146                 default:
 147                         KASSERT(entry->ae_tag == ACL_EVERYONE,
 148                             ("entry->ae_tag == ACL_EVERYONE"));
 149                 }
 150
 151                 if (entry->ae_entry_type == ACL_ENTRY_TYPE_DENY) {
 152                         if (entry->ae_perm & access_mask) {
 153                                 if (denied_explicitly != NULL)
 154                                         *denied_explicitly = 1;
 155                                 return (1);
 156                         }
 157                 }
 158
 159                 access_mask &= ~(entry->ae_perm);
 160                 if (access_mask == 0)
 161                         return (0);
 162         }
 163
 164         return (1);
 165 }
 166
 167 int
 168 vaccess_acl_nfs4(enum vtype type, uid_t file_uid, gid_t file_gid,
 169     struct acl *aclp, accmode_t accmode, struct ucred *cred, int *privused)
 170 {
 171         accmode_t priv_granted = 0;
 172         int denied, explicitly_denied, access_mask, is_directory,
 173             must_be_owner = 0;
 174         mode_t file_mode = 0;
 175
 176         KASSERT((accmode & ~(VEXEC | VWRITE | VREAD | VADMIN | VAPPEND |
 177             VEXPLICIT_DENY | VREAD_NAMED_ATTRS | VWRITE_NAMED_ATTRS |
 178             VDELETE_CHILD | VREAD_ATTRIBUTES | VWRITE_ATTRIBUTES | VDELETE |
 179             VREAD_ACL | VWRITE_ACL | VWRITE_OWNER | VSYNCHRONIZE)) == 0,
 180             ("invalid bit in accmode"));
 181         KASSERT((accmode & VAPPEND) == 0 || (accmode & VWRITE),
 182                 ("VAPPEND without VWRITE"));
 183
 184         if (privused != NULL)
 185                 *privused = 0;
 186
 187         if (accmode & VADMIN)
 188                 must_be_owner = 1;
 189
 190         /*
 191          * Ignore VSYNCHRONIZE permission.
 192          */
 193         accmode &= ~VSYNCHRONIZE;
 194
 195         access_mask = _access_mask_from_accmode(accmode);
 196
 197         if (type == VDIR)
 198                 is_directory = 1;
 199         else
 200                 is_directory = 0;
 201
 202         /*
 203          * File owner is always allowed to read and write the ACL
 204          * and basic attributes.  This is to prevent a situation
 205          * where user would change ACL in a way that prevents him
 206          * from undoing the change.
 207          */
 208         if (file_uid == cred->cr_uid)
 209                 access_mask &= ~(ACL_READ_ACL | ACL_WRITE_ACL |
 210                     ACL_READ_ATTRIBUTES | ACL_WRITE_ATTRIBUTES);
 211
 212         /*
 213          * Ignore append permission for regular files; use write
 214          * permission instead.
 215          */
 216         if (!is_directory && (access_mask & ACL_APPEND_DATA)) {
 217                 access_mask &= ~ACL_APPEND_DATA;
 218                 access_mask |= ACL_WRITE_DATA;
 219         }
 220
 221         denied = _acl_denies(aclp, access_mask, cred, file_uid, file_gid,
 222             &explicitly_denied);
 223
 224         if (must_be_owner) {
 225                 if (file_uid != cred->cr_uid)
 226                         denied = EPERM;
 227         }
 228
 229         /*
 230          * For VEXEC, ensure that at least one execute bit is set for
 231          * non-directories. We have to check the mode here to stay
 232          * consistent with execve(2). See the test in
 233          * exec_check_permissions().
 234          */
 235         acl_nfs4_sync_mode_from_acl(&file_mode, aclp);
 236         if (!denied && !is_directory && (accmode & VEXEC) &&
 237             (file_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0)
 238                 denied = EACCES;
 239
 240         if (!denied)
 241                 return (0);
 242
 243         /*
 244          * Access failed.  Iff it was not denied explicitly and
 245          * VEXPLICIT_DENY flag was specified, allow access.
 246          */
 247         if ((accmode & VEXPLICIT_DENY) && explicitly_denied == 0)
 248                 return (0);
 249
 250         accmode &= ~VEXPLICIT_DENY;
 251
 252         /*
 253          * No match.  Try to use privileges, if there are any.
 254          */
 255         if (is_directory) {
 256                 if ((accmode & VEXEC) && !priv_check_cred(cred,
 257                     PRIV_VFS_LOOKUP, 0))
 258                         priv_granted |= VEXEC;
 259         } else {
 260                 /*
 261                  * Ensure that at least one execute bit is on. Otherwise,
 262                  * a privileged user will always succeed, and we don't want
 263                  * this to happen unless the file really is executable.
 264                  */
 265                 if ((accmode & VEXEC) && (file_mode &
 266                     (S_IXUSR | S_IXGRP | S_IXOTH)) != 0 &&
 267                     !priv_check_cred(cred, PRIV_VFS_EXEC, 0))
 268                         priv_granted |= VEXEC;
 269         }
 270
 271         if ((accmode & VREAD) && !priv_check_cred(cred, PRIV_VFS_READ, 0))
 272                 priv_granted |= VREAD;
 273
 274         if ((accmode & (VWRITE | VAPPEND | VDELETE_CHILD)) &&
 275             !priv_check_cred(cred, PRIV_VFS_WRITE, 0))
 276                 priv_granted |= (VWRITE | VAPPEND | VDELETE_CHILD);
 277
 278         if ((accmode & VADMIN_PERMS) &&
 279             !priv_check_cred(cred, PRIV_VFS_ADMIN, 0))
 280                 priv_granted |= VADMIN_PERMS;
 281
 282         if ((accmode & VSTAT_PERMS) &&
 283             !priv_check_cred(cred, PRIV_VFS_STAT, 0))
 284                 priv_granted |= VSTAT_PERMS;
 285
 286         if ((accmode & priv_granted) == accmode) {
 287                 if (privused != NULL)
 288                         *privused = 1;
 289
 290                 return (0);
 291         }
 292
 293         if (accmode & (VADMIN_PERMS | VDELETE_CHILD | VDELETE))
 294                 denied = EPERM;
 295         else
 296                 denied = EACCES;
 297
 298         return (denied);
 299 }
 300 #endif /* _KERNEL */
 301
 302 static int
 303 _acl_entry_matches(struct acl_entry *entry, acl_tag_t tag, acl_perm_t perm,
 304     acl_entry_type_t entry_type)
 305 {
 306         if (entry->ae_tag != tag)
 307                 return (0);
 308
 309         if (entry->ae_id != ACL_UNDEFINED_ID)
 310                 return (0);
 311
 312         if (entry->ae_perm != perm)
 313                 return (0);
 314
 315         if (entry->ae_entry_type != entry_type)
 316                 return (0);
 317
 318         if (entry->ae_flags != 0)
 319                 return (0);
 320
 321         return (1);
 322 }
 323
 324 static struct acl_entry *
 325 _acl_append(struct acl *aclp, acl_tag_t tag, acl_perm_t perm,
 326     acl_entry_type_t entry_type)
 327 {
 328         struct acl_entry *entry;
 329
 330         KASSERT(aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES,
 331             ("aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES"));
 332
 333         entry = &(aclp->acl_entry[aclp->acl_cnt]);
 334         aclp->acl_cnt++;
 335
 336         entry->ae_tag = tag;
 337         entry->ae_id = ACL_UNDEFINED_ID;
 338         entry->ae_perm = perm;
 339         entry->ae_entry_type = entry_type;
 340         entry->ae_flags = 0;
 341
 342         return (entry);
 343 }
 344
 345 static struct acl_entry *
 346 _acl_duplicate_entry(struct acl *aclp, int entry_index)
 347 {
 348         int i;
 349
 350         KASSERT(aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES,
 351             ("aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES"));
 352
 353         for (i = aclp->acl_cnt; i > entry_index; i--)
 354                 aclp->acl_entry[i] = aclp->acl_entry[i - 1];
 355
 356         aclp->acl_cnt++;
 357
 358         return (&(aclp->acl_entry[entry_index + 1]));
 359 }
 360
 361 static void
 362 acl_nfs4_sync_acl_from_mode_draft(struct acl *aclp, mode_t mode,
 363     int file_owner_id)
 364 {
 365         int i, meets, must_append;
 366         struct acl_entry *entry, *copy, *previous,
 367             *a1, *a2, *a3, *a4, *a5, *a6;
 368         mode_t amode;
 369         const int READ = 04;
 370         const int WRITE = 02;
 371         const int EXEC = 01;
 372
 373         KASSERT(aclp->acl_cnt <= ACL_MAX_ENTRIES,
 374             ("aclp->acl_cnt <= ACL_MAX_ENTRIES"));
 375
 376         /*
 377          * NFSv4 Minor Version 1, draft-ietf-nfsv4-minorversion1-03.txt
 378          *
 379          * 3.16.6.3. Applying a Mode to an Existing ACL
 380          */
 381
 382         /*
 383          * 1. For each ACE:
 384          */
 385         for (i = 0; i < aclp->acl_cnt; i++) {
 386                 entry = &(aclp->acl_entry[i]);
 387
 388                 /*
 389                  * 1.1. If the type is neither ALLOW or DENY - skip.
 390                  */
 391                 if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW &&
 392                     entry->ae_entry_type != ACL_ENTRY_TYPE_DENY)
 393                         continue;
 394
 395                 /*
 396                  * 1.2. If ACL_ENTRY_INHERIT_ONLY is set - skip.
 397                  */
 398                 if (entry->ae_flags & ACL_ENTRY_INHERIT_ONLY)
 399                         continue;
 400
 401                 /*
 402                  * 1.3. If ACL_ENTRY_FILE_INHERIT or ACL_ENTRY_DIRECTORY_INHERIT
 403                  *      are set:
 404                  */
 405                 if (entry->ae_flags &
 406                     (ACL_ENTRY_FILE_INHERIT | ACL_ENTRY_DIRECTORY_INHERIT)) {
 407                         /*
 408                          * 1.3.1. A copy of the current ACE is made, and placed
 409                          *        in the ACL immediately following the current
 410                          *        ACE.
 411                          */
 412                         copy = _acl_duplicate_entry(aclp, i);
 413
 414                         /*
 415                          * 1.3.2. In the first ACE, the flag
 416                          *        ACL_ENTRY_INHERIT_ONLY is set.
 417                          */
 418                         entry->ae_flags |= ACL_ENTRY_INHERIT_ONLY;
 419
 420                         /*
 421                          * 1.3.3. In the second ACE, the following flags
 422                          *        are cleared:
 423                          *        ACL_ENTRY_FILE_INHERIT,
 424                          *        ACL_ENTRY_DIRECTORY_INHERIT,
 425                          *        ACL_ENTRY_NO_PROPAGATE_INHERIT.
 426                          */
 427                         copy->ae_flags &= ~(ACL_ENTRY_FILE_INHERIT |
 428                             ACL_ENTRY_DIRECTORY_INHERIT |
 429                             ACL_ENTRY_NO_PROPAGATE_INHERIT);
 430
 431                         /*
 432                          * The algorithm continues on with the second ACE.
 433                          */
 434                         i++;
 435                         entry = copy;
 436                 }
 437
 438                 /*
 439                  * 1.4. If it's owner@, group@ or everyone@ entry, clear
 440                  *      ACL_READ_DATA, ACL_WRITE_DATA, ACL_APPEND_DATA
 441                  *      and ACL_EXECUTE.  Continue to the next entry.
 442                  */
 443                 if (entry->ae_tag == ACL_USER_OBJ ||
 444                     entry->ae_tag == ACL_GROUP_OBJ ||
 445                     entry->ae_tag == ACL_EVERYONE) {
 446                         entry->ae_perm &= ~(ACL_READ_DATA | ACL_WRITE_DATA |
 447                             ACL_APPEND_DATA | ACL_EXECUTE);
 448                         continue;
 449                 }
 450
 451                 /*
 452                  * 1.5. Otherwise, if the "who" field did not match one
 453                  *      of OWNER@, GROUP@, EVERYONE@:
 454                  *
 455                  * 1.5.1. If the type is ALLOW, check the preceding ACE.
 456                  *        If it does not meet all of the following criteria:
 457                  */
 458                 if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW)
 459                         continue;
 460
 461                 meets = 0;
 462                 if (i > 0) {
 463                         meets = 1;
 464                         previous = &(aclp->acl_entry[i - 1]);
 465
 466                         /*
 467                          * 1.5.1.1. The type field is DENY,
 468                          */
 469                         if (previous->ae_entry_type != ACL_ENTRY_TYPE_DENY)
 470                                 meets = 0;
 471
 472                         /*
 473                          * 1.5.1.2. The "who" field is the same as the current
 474                          *          ACE,
 475                          *
 476                          * 1.5.1.3. The flag bit ACE4_IDENTIFIER_GROUP
 477                          *          is the same as it is in the current ACE,
 478                          *          and no other flag bits are set,
 479                          */
 480                         if (previous->ae_id != entry->ae_id ||
 481                             previous->ae_tag != entry->ae_tag)
 482                                 meets = 0;
 483
 484                         if (previous->ae_flags)
 485                                 meets = 0;
 486
 487                         /*
 488                          * 1.5.1.4. The mask bits are a subset of the mask bits
 489                          *          of the current ACE, and are also subset of
 490                          *          the following: ACL_READ_DATA,
 491                          *          ACL_WRITE_DATA, ACL_APPEND_DATA, ACL_EXECUTE
 492                          */
 493                         if (previous->ae_perm & ~(entry->ae_perm))
 494                                 meets = 0;
 495
 496                         if (previous->ae_perm & ~(ACL_READ_DATA |
 497                             ACL_WRITE_DATA | ACL_APPEND_DATA | ACL_EXECUTE))
 498                                 meets = 0;
 499                 }
 500
 501                 if (!meets) {
 502                         /*
 503                          * Then the ACE of type DENY, with a who equal
 504                          * to the current ACE, flag bits equal to
 505                          * (<current ACE flags> & <ACE_IDENTIFIER_GROUP>)
 506                          * and no mask bits, is prepended.
 507                          */
 508                         previous = entry;
 509                         entry = _acl_duplicate_entry(aclp, i);
 510
 511                         /* Adjust counter, as we've just added an entry. */
 512                         i++;
 513
 514                         previous->ae_tag = entry->ae_tag;
 515                         previous->ae_id = entry->ae_id;
 516                         previous->ae_flags = entry->ae_flags;
 517                         previous->ae_perm = 0;
 518                         previous->ae_entry_type = ACL_ENTRY_TYPE_DENY;
 519                 }
 520
 521                 /*
 522                  * 1.5.2. The following modifications are made to the prepended
 523                  *        ACE.  The intent is to mask the following ACE
 524                  *        to disallow ACL_READ_DATA, ACL_WRITE_DATA,
 525                  *        ACL_APPEND_DATA, or ACL_EXECUTE, based upon the group
 526                  *        permissions of the new mode.  As a special case,
 527                  *        if the ACE matches the current owner of the file,
 528                  *        the owner bits are used, rather than the group bits.
 529                  *        This is reflected in the algorithm below.
 530                  */
 531                 amode = mode >> 3;
 532
 533                 /*
 534                  * If ACE4_IDENTIFIER_GROUP is not set, and the "who" field
 535                  * in ACE matches the owner of the file, we shift amode three
 536                  * more bits, in order to have the owner permission bits
 537                  * placed in the three low order bits of amode.
 538                  */
 539                 if (entry->ae_tag == ACL_USER && entry->ae_id == file_owner_id)
 540                         amode = amode >> 3;
 541
 542                 if (entry->ae_perm & ACL_READ_DATA) {
 543                         if (amode & READ)
 544                                 previous->ae_perm &= ~ACL_READ_DATA;
 545                         else
 546                                 previous->ae_perm |= ACL_READ_DATA;
 547                 }
 548
 549                 if (entry->ae_perm & ACL_WRITE_DATA) {
 550                         if (amode & WRITE)
 551                                 previous->ae_perm &= ~ACL_WRITE_DATA;
 552                         else
 553                                 previous->ae_perm |= ACL_WRITE_DATA;
 554                 }
 555
 556                 if (entry->ae_perm & ACL_APPEND_DATA) {
 557                         if (amode & WRITE)
 558                                 previous->ae_perm &= ~ACL_APPEND_DATA;
 559                         else
 560                                 previous->ae_perm |= ACL_APPEND_DATA;
 561                 }
 562
 563                 if (entry->ae_perm & ACL_EXECUTE) {
 564                         if (amode & EXEC)
 565                                 previous->ae_perm &= ~ACL_EXECUTE;
 566                         else
 567                                 previous->ae_perm |= ACL_EXECUTE;
 568                 }
 569
 570                 /*
 571                  * 1.5.3. If ACE4_IDENTIFIER_GROUP is set in the flags
 572                  *        of the ALLOW ace:
 573                  *
 574                  * XXX: This point is not there in the Falkner's draft.
 575                  */
 576                 if (entry->ae_tag == ACL_GROUP &&
 577                     entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW) {
 578                         mode_t extramode, ownermode;
 579                         extramode = (mode >> 3) & 07;
 580                         ownermode = mode >> 6;
 581                         extramode &= ~ownermode;
 582
 583                         if (extramode) {
 584                                 if (extramode & READ) {
 585                                         entry->ae_perm &= ~ACL_READ_DATA;
 586                                         previous->ae_perm &= ~ACL_READ_DATA;
 587                                 }
 588
 589                                 if (extramode & WRITE) {
 590                                         entry->ae_perm &=
 591                                             ~(ACL_WRITE_DATA | ACL_APPEND_DATA);
 592                                         previous->ae_perm &=
 593                                             ~(ACL_WRITE_DATA | ACL_APPEND_DATA);
 594                                 }
 595
 596                                 if (extramode & EXEC) {
 597                                         entry->ae_perm &= ~ACL_EXECUTE;
 598                                         previous->ae_perm &= ~ACL_EXECUTE;
 599                                 }
 600                         }
 601                 }
 602         }
 603
 604         /*
 605          * 2. If there at least six ACEs, the final six ACEs are examined.
 606          *    If they are not equal to what we want, append six ACEs.
 607          */
 608         must_append = 0;
 609         if (aclp->acl_cnt < 6) {
 610                 must_append = 1;
 611         } else {
 612                 a6 = &(aclp->acl_entry[aclp->acl_cnt - 1]);
 613                 a5 = &(aclp->acl_entry[aclp->acl_cnt - 2]);
 614                 a4 = &(aclp->acl_entry[aclp->acl_cnt - 3]);
 615                 a3 = &(aclp->acl_entry[aclp->acl_cnt - 4]);
 616                 a2 = &(aclp->acl_entry[aclp->acl_cnt - 5]);
 617                 a1 = &(aclp->acl_entry[aclp->acl_cnt - 6]);
 618
 619                 if (!_acl_entry_matches(a1, ACL_USER_OBJ, 0,
 620                     ACL_ENTRY_TYPE_DENY))
 621                         must_append = 1;
 622                 if (!_acl_entry_matches(a2, ACL_USER_OBJ, ACL_WRITE_ACL |
 623                     ACL_WRITE_OWNER | ACL_WRITE_ATTRIBUTES |
 624                     ACL_WRITE_NAMED_ATTRS, ACL_ENTRY_TYPE_ALLOW))
 625                         must_append = 1;
 626                 if (!_acl_entry_matches(a3, ACL_GROUP_OBJ, 0,
 627                     ACL_ENTRY_TYPE_DENY))
 628                         must_append = 1;
 629                 if (!_acl_entry_matches(a4, ACL_GROUP_OBJ, 0,
 630                     ACL_ENTRY_TYPE_ALLOW))
 631                         must_append = 1;
 632                 if (!_acl_entry_matches(a5, ACL_EVERYONE, ACL_WRITE_ACL |
 633                     ACL_WRITE_OWNER | ACL_WRITE_ATTRIBUTES |
 634                     ACL_WRITE_NAMED_ATTRS, ACL_ENTRY_TYPE_DENY))
 635                         must_append = 1;
 636                 if (!_acl_entry_matches(a6, ACL_EVERYONE, ACL_READ_ACL |
 637                     ACL_READ_ATTRIBUTES | ACL_READ_NAMED_ATTRS |
 638                     ACL_SYNCHRONIZE, ACL_ENTRY_TYPE_ALLOW))
 639                         must_append = 1;
 640         }
 641
 642         if (must_append) {
 643                 KASSERT(aclp->acl_cnt + 6 <= ACL_MAX_ENTRIES,
 644                     ("aclp->acl_cnt <= ACL_MAX_ENTRIES"));
 645
 646                 a1 = _acl_append(aclp, ACL_USER_OBJ, 0, ACL_ENTRY_TYPE_DENY);
 647                 a2 = _acl_append(aclp, ACL_USER_OBJ, ACL_WRITE_ACL |
 648                     ACL_WRITE_OWNER | ACL_WRITE_ATTRIBUTES |
 649                     ACL_WRITE_NAMED_ATTRS, ACL_ENTRY_TYPE_ALLOW);
 650                 a3 = _acl_append(aclp, ACL_GROUP_OBJ, 0, ACL_ENTRY_TYPE_DENY);
 651                 a4 = _acl_append(aclp, ACL_GROUP_OBJ, 0, ACL_ENTRY_TYPE_ALLOW);
 652                 a5 = _acl_append(aclp, ACL_EVERYONE, ACL_WRITE_ACL |
 653                     ACL_WRITE_OWNER | ACL_WRITE_ATTRIBUTES |
 654                     ACL_WRITE_NAMED_ATTRS, ACL_ENTRY_TYPE_DENY);
 655                 a6 = _acl_append(aclp, ACL_EVERYONE, ACL_READ_ACL |
 656                     ACL_READ_ATTRIBUTES | ACL_READ_NAMED_ATTRS |
 657                     ACL_SYNCHRONIZE, ACL_ENTRY_TYPE_ALLOW);
 658
 659                 KASSERT(a1 != NULL && a2 != NULL && a3 != NULL && a4 != NULL &&
 660                     a5 != NULL && a6 != NULL, ("couldn't append to ACL."));
 661         }
 662
 663         /*
 664          * 3. The final six ACEs are adjusted according to the incoming mode.
 665          */
 666         if (mode & S_IRUSR)
 667                 a2->ae_perm |= ACL_READ_DATA;
 668         else
 669                 a1->ae_perm |= ACL_READ_DATA;
 670         if (mode & S_IWUSR)
 671                 a2->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
 672         else
 673                 a1->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
 674         if (mode & S_IXUSR)
 675                 a2->ae_perm |= ACL_EXECUTE;
 676         else
 677                 a1->ae_perm |= ACL_EXECUTE;
 678
 679         if (mode & S_IRGRP)
 680                 a4->ae_perm |= ACL_READ_DATA;
 681         else
 682                 a3->ae_perm |= ACL_READ_DATA;
 683         if (mode & S_IWGRP)
 684                 a4->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
 685         else
 686                 a3->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
 687         if (mode & S_IXGRP)
 688                 a4->ae_perm |= ACL_EXECUTE;
 689         else
 690                 a3->ae_perm |= ACL_EXECUTE;
 691
 692         if (mode & S_IROTH)
 693                 a6->ae_perm |= ACL_READ_DATA;
 694         else
 695                 a5->ae_perm |= ACL_READ_DATA;
 696         if (mode & S_IWOTH)
 697                 a6->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
 698         else
 699                 a5->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
 700         if (mode & S_IXOTH)
 701                 a6->ae_perm |= ACL_EXECUTE;
 702         else
 703                 a5->ae_perm |= ACL_EXECUTE;
 704 }
 705
 706 #ifdef _KERNEL
 707 void
 708 acl_nfs4_sync_acl_from_mode(struct acl *aclp, mode_t mode,
 709     int file_owner_id)
 710 {
 711
 712         if (acl_nfs4_old_semantics)
 713                 acl_nfs4_sync_acl_from_mode_draft(aclp, mode, file_owner_id);
 714         else
 715                 acl_nfs4_trivial_from_mode(aclp, mode);
 716 }
 717 #endif /* _KERNEL */
 718
 719 void
 720 acl_nfs4_sync_mode_from_acl(mode_t *_mode, const struct acl *aclp)
 721 {
 722         int i;
 723         mode_t old_mode = *_mode, mode = 0, seen = 0;
 724         const struct acl_entry *entry;
 725
 726         KASSERT(aclp->acl_cnt > 0, ("aclp->acl_cnt > 0"));
 727         KASSERT(aclp->acl_cnt <= ACL_MAX_ENTRIES,
 728             ("aclp->acl_cnt <= ACL_MAX_ENTRIES"));
 729
 730         /*
 731          * NFSv4 Minor Version 1, draft-ietf-nfsv4-minorversion1-03.txt
 732          *
 733          * 3.16.6.1. Recomputing mode upon SETATTR of ACL
 734          */
 735
 736         for (i = 0; i < aclp->acl_cnt; i++) {
 737                 entry = &(aclp->acl_entry[i]);
 738
 739                 if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW &&
 740                     entry->ae_entry_type != ACL_ENTRY_TYPE_DENY)
 741                         continue;
 742
 743                 if (entry->ae_flags & ACL_ENTRY_INHERIT_ONLY)
 744                         continue;
 745
 746                 if (entry->ae_tag == ACL_USER_OBJ) {
 747                         if ((entry->ae_perm & ACL_READ_DATA) &&
 748                             ((seen & S_IRUSR) == 0)) {
 749                                 seen |= S_IRUSR;
 750                                 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 751                                         mode |= S_IRUSR;
 752                         }
 753                         if ((entry->ae_perm & ACL_WRITE_DATA) &&
 754                              ((seen & S_IWUSR) == 0)) {
 755                                 seen |= S_IWUSR;
 756                                 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 757                                         mode |= S_IWUSR;
 758                         }
 759                         if ((entry->ae_perm & ACL_EXECUTE) &&
 760                             ((seen & S_IXUSR) == 0)) {
 761                                 seen |= S_IXUSR;
 762                                 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 763                                         mode |= S_IXUSR;
 764                         }
 765                 } else if (entry->ae_tag == ACL_GROUP_OBJ) {
 766                         if ((entry->ae_perm & ACL_READ_DATA) &&
 767                             ((seen & S_IRGRP) == 0)) {
 768                                 seen |= S_IRGRP;
 769                                 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 770                                         mode |= S_IRGRP;
 771                         }
 772                         if ((entry->ae_perm & ACL_WRITE_DATA) &&
 773                             ((seen & S_IWGRP) == 0)) {
 774                                 seen |= S_IWGRP;
 775                                 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 776                                         mode |= S_IWGRP;
 777                         }
 778                         if ((entry->ae_perm & ACL_EXECUTE) &&
 779                             ((seen & S_IXGRP) == 0)) {
 780                                 seen |= S_IXGRP;
 781                                 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 782                                         mode |= S_IXGRP;
 783                         }
 784                 } else if (entry->ae_tag == ACL_EVERYONE) {
 785                         if (entry->ae_perm & ACL_READ_DATA) {
 786                                 if ((seen & S_IRUSR) == 0) {
 787                                         seen |= S_IRUSR;
 788                                         if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 789                                                 mode |= S_IRUSR;
 790                                 }
 791                                 if ((seen & S_IRGRP) == 0) {
 792                                         seen |= S_IRGRP;
 793                                         if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 794                                                 mode |= S_IRGRP;
 795                                 }
 796                                 if ((seen & S_IROTH) == 0) {
 797                                         seen |= S_IROTH;
 798                                         if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 799                                                 mode |= S_IROTH;
 800                                 }
 801                         }
 802                         if (entry->ae_perm & ACL_WRITE_DATA) {
 803                                 if ((seen & S_IWUSR) == 0) {
 804                                         seen |= S_IWUSR;
 805                                         if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 806                                                 mode |= S_IWUSR;
 807                                 }
 808                                 if ((seen & S_IWGRP) == 0) {
 809                                         seen |= S_IWGRP;
 810                                         if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 811                                                 mode |= S_IWGRP;
 812                                 }
 813                                 if ((seen & S_IWOTH) == 0) {
 814                                         seen |= S_IWOTH;
 815                                         if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 816                                                 mode |= S_IWOTH;
 817                                 }
 818                         }
 819                         if (entry->ae_perm & ACL_EXECUTE) {
 820                                 if ((seen & S_IXUSR) == 0) {
 821                                         seen |= S_IXUSR;
 822                                         if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 823                                                 mode |= S_IXUSR;
 824                                 }
 825                                 if ((seen & S_IXGRP) == 0) {
 826                                         seen |= S_IXGRP;
 827                                         if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 828                                                 mode |= S_IXGRP;
 829                                 }
 830                                 if ((seen & S_IXOTH) == 0) {
 831                                         seen |= S_IXOTH;
 832                                         if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 833                                                 mode |= S_IXOTH;
 834                                 }
 835                         }
 836                 }
 837         }
 838
 839         *_mode = mode | (old_mode & ACL_PRESERVE_MASK);
 840 }
 841
 842 #ifdef _KERNEL
 843 /*
 844  * Calculate inherited ACL in a manner compatible with NFSv4 Minor Version 1,
 845  * draft-ietf-nfsv4-minorversion1-03.txt.
 846  */
 847 static void
 848 acl_nfs4_compute_inherited_acl_draft(const struct acl *parent_aclp,
 849     struct acl *child_aclp, mode_t mode, int file_owner_id,
 850     int is_directory)
 851 {
 852         int i, flags;
 853         const struct acl_entry *parent_entry;
 854         struct acl_entry *entry, *copy;
 855
 856         KASSERT(child_aclp->acl_cnt == 0, ("child_aclp->acl_cnt == 0"));
 857         KASSERT(parent_aclp->acl_cnt > 0, ("parent_aclp->acl_cnt > 0"));
 858         KASSERT(parent_aclp->acl_cnt <= ACL_MAX_ENTRIES,
 859             ("parent_aclp->acl_cnt <= ACL_MAX_ENTRIES"));
 860
 861         /*
 862          * NFSv4 Minor Version 1, draft-ietf-nfsv4-minorversion1-03.txt
 863          *
 864          * 3.16.6.2. Applying the mode given to CREATE or OPEN
 865          *           to an inherited ACL
 866          */
 867
 868         /*
 869          * 1. Form an ACL that is the concatenation of all inheritable ACEs.
 870          */
 871         for (i = 0; i < parent_aclp->acl_cnt; i++) {
 872                 parent_entry = &(parent_aclp->acl_entry[i]);
 873                 flags = parent_entry->ae_flags;
 874
 875                 /*
 876                  * Entry is not inheritable at all.
 877                  */
 878                 if ((flags & (ACL_ENTRY_DIRECTORY_INHERIT |
 879                     ACL_ENTRY_FILE_INHERIT)) == 0)
 880                         continue;
 881
 882                 /*
 883                  * We're creating a file, but entry is not inheritable
 884                  * by files.
 885                  */
 886                 if (!is_directory && (flags & ACL_ENTRY_FILE_INHERIT) == 0)
 887                         continue;
 888
 889                 /*
 890                  * Entry is inheritable only by files, but has NO_PROPAGATE
 891                  * flag set, and we're creating a directory, so it wouldn't
 892                  * propagate to any file in that directory anyway.
 893                  */
 894                 if (is_directory &&
 895                     (flags & ACL_ENTRY_DIRECTORY_INHERIT) == 0 &&
 896                     (flags & ACL_ENTRY_NO_PROPAGATE_INHERIT))
 897                         continue;
 898
 899                 KASSERT(child_aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES,
 900                     ("child_aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES"));
 901                 child_aclp->acl_entry[child_aclp->acl_cnt] = *parent_entry;
 902                 child_aclp->acl_cnt++;
 903         }
 904
 905         /*
 906          * 2. For each entry in the new ACL, adjust its flags, possibly
 907          *    creating two entries in place of one.
 908          */
 909         for (i = 0; i < child_aclp->acl_cnt; i++) {
 910                 entry = &(child_aclp->acl_entry[i]);
 911
 912                 /*
 913                  * This is not in the specification, but SunOS
 914                  * apparently does that.
 915                  */
 916                 if (((entry->ae_flags & ACL_ENTRY_NO_PROPAGATE_INHERIT) ||
 917                     !is_directory) &&
 918                     entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 919                         entry->ae_perm &= ~(ACL_WRITE_ACL | ACL_WRITE_OWNER);
 920
 921                 /*
 922                  * 2.A. If the ACL_ENTRY_NO_PROPAGATE_INHERIT is set, or if the object
 923                  *      being created is not a directory, then clear the
 924                  *      following flags: ACL_ENTRY_NO_PROPAGATE_INHERIT,
 925                  *      ACL_ENTRY_FILE_INHERIT, ACL_ENTRY_DIRECTORY_INHERIT,
 926                  *      ACL_ENTRY_INHERIT_ONLY.
 927                  */
 928                 if (entry->ae_flags & ACL_ENTRY_NO_PROPAGATE_INHERIT ||
 929                     !is_directory) {
 930                         entry->ae_flags &= ~(ACL_ENTRY_NO_PROPAGATE_INHERIT |
 931                         ACL_ENTRY_FILE_INHERIT | ACL_ENTRY_DIRECTORY_INHERIT |
 932                         ACL_ENTRY_INHERIT_ONLY);
 933
 934                         /*
 935                          * Continue on to the next ACE.
 936                          */
 937                         continue;
 938                 }
 939
 940                 /*
 941                  * 2.B. If the object is a directory and ACL_ENTRY_FILE_INHERIT
 942                  *      is set, but ACL_ENTRY_NO_PROPAGATE_INHERIT is not set, ensure
 943                  *      that ACL_ENTRY_INHERIT_ONLY is set.  Continue to the
 944                  *      next ACE.  Otherwise...
 945                  */
 946                 /*
 947                  * XXX: Read it again and make sure what does the "otherwise"
 948                  *      apply to.
 949                  */
 950                 if (is_directory &&
 951                     (entry->ae_flags & ACL_ENTRY_FILE_INHERIT) &&
 952                     ((entry->ae_flags & ACL_ENTRY_DIRECTORY_INHERIT) == 0)) {
 953                         entry->ae_flags |= ACL_ENTRY_INHERIT_ONLY;
 954                         continue;
 955                 }
 956
 957                 /*
 958                  * 2.C. If the type of the ACE is neither ALLOW nor deny,
 959                  *      then continue.
 960                  */
 961                 if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW &&
 962                     entry->ae_entry_type != ACL_ENTRY_TYPE_DENY)
 963                         continue;
 964
 965                 /*
 966                  * 2.D. Copy the original ACE into a second, adjacent ACE.
 967                  */
 968                 copy = _acl_duplicate_entry(child_aclp, i);
 969
 970                 /*
 971                  * 2.E. On the first ACE, ensure that ACL_ENTRY_INHERIT_ONLY
 972                  *      is set.
 973                  */
 974                 entry->ae_flags |= ACL_ENTRY_INHERIT_ONLY;
 975
 976                 /*
 977                  * 2.F. On the second ACE, clear the following flags:
 978                  *      ACL_ENTRY_NO_PROPAGATE_INHERIT, ACL_ENTRY_FILE_INHERIT,
 979                  *      ACL_ENTRY_DIRECTORY_INHERIT, ACL_ENTRY_INHERIT_ONLY.
 980                  */
 981                 copy->ae_flags &= ~(ACL_ENTRY_NO_PROPAGATE_INHERIT |
 982                     ACL_ENTRY_FILE_INHERIT | ACL_ENTRY_DIRECTORY_INHERIT |
 983                     ACL_ENTRY_INHERIT_ONLY);
 984
 985                 /*
 986                  * 2.G. On the second ACE, if the type is ALLOW,
 987                  *      an implementation MAY clear the following
 988                  *      mask bits: ACL_WRITE_ACL, ACL_WRITE_OWNER.
 989                  */
 990                 if (copy->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
 991                         copy->ae_perm &= ~(ACL_WRITE_ACL | ACL_WRITE_OWNER);
 992
 993                 /*
 994                  * Increment the counter to skip the copied entry.
 995                  */
 996                 i++;
 997         }
 998
 999         /*
1000          * 3. To ensure that the mode is honored, apply the algorithm describe
1001          *    in Section 2.16.6.3, using the mode that is to be used for file
1002          *    creation.
1003          */
1004         acl_nfs4_sync_acl_from_mode(child_aclp, mode, file_owner_id);
1005 }
1006 #endif /* _KERNEL */
1007
1008 /*
1009  * Populate the ACL with entries inherited from parent_aclp.
1010  */
1011 static void
1012 acl_nfs4_inherit_entries(const struct acl *parent_aclp,
1013     struct acl *child_aclp, mode_t mode, int file_owner_id,
1014     int is_directory)
1015 {
1016         int i, flags, tag;
1017         const struct acl_entry *parent_entry;
1018         struct acl_entry *entry;
1019
1020         KASSERT(parent_aclp->acl_cnt > 0, ("parent_aclp->acl_cnt > 0"));
1021         KASSERT(parent_aclp->acl_cnt <= ACL_MAX_ENTRIES,
1022             ("parent_aclp->acl_cnt <= ACL_MAX_ENTRIES"));
1023
1024         for (i = 0; i < parent_aclp->acl_cnt; i++) {
1025                 parent_entry = &(parent_aclp->acl_entry[i]);
1026                 flags = parent_entry->ae_flags;
1027                 tag = parent_entry->ae_tag;
1028
1029                 /*
1030                  * Don't inherit owner@, group@, or everyone@ entries.
1031                  */
1032                 if (tag == ACL_USER_OBJ || tag == ACL_GROUP_OBJ ||
1033                     tag == ACL_EVERYONE)
1034                         continue;
1035
1036                 /*
1037                  * Entry is not inheritable at all.
1038                  */
1039                 if ((flags & (ACL_ENTRY_DIRECTORY_INHERIT |
1040                     ACL_ENTRY_FILE_INHERIT)) == 0)
1041                         continue;
1042
1043                 /*
1044                  * We're creating a file, but entry is not inheritable
1045                  * by files.
1046                  */
1047                 if (!is_directory && (flags & ACL_ENTRY_FILE_INHERIT) == 0)
1048                         continue;
1049
1050                 /*
1051                  * Entry is inheritable only by files, but has NO_PROPAGATE
1052                  * flag set, and we're creating a directory, so it wouldn't
1053                  * propagate to any file in that directory anyway.
1054                  */
1055                 if (is_directory &&
1056                     (flags & ACL_ENTRY_DIRECTORY_INHERIT) == 0 &&
1057                     (flags & ACL_ENTRY_NO_PROPAGATE_INHERIT))
1058                         continue;
1059
1060                 /*
1061                  * Entry qualifies for being inherited.
1062                  */
1063                 KASSERT(child_aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES,
1064                     ("child_aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES"));
1065                 entry = &(child_aclp->acl_entry[child_aclp->acl_cnt]);
1066                 *entry = *parent_entry;
1067                 child_aclp->acl_cnt++;
1068
1069                 entry->ae_flags &= ~ACL_ENTRY_INHERIT_ONLY;
1070
1071                 /*
1072                  * If the type of the ACE is neither ALLOW nor DENY,
1073                  * then leave it as it is and proceed to the next one.
1074                  */
1075                 if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW &&
1076                     entry->ae_entry_type != ACL_ENTRY_TYPE_DENY)
1077                         continue;
1078
1079                 /*
1080                  * If the ACL_ENTRY_NO_PROPAGATE_INHERIT is set, or if
1081                  * the object being created is not a directory, then clear
1082                  * the following flags: ACL_ENTRY_NO_PROPAGATE_INHERIT,
1083                  * ACL_ENTRY_FILE_INHERIT, ACL_ENTRY_DIRECTORY_INHERIT,
1084                  * ACL_ENTRY_INHERIT_ONLY.
1085                  */
1086                 if (entry->ae_flags & ACL_ENTRY_NO_PROPAGATE_INHERIT ||
1087                     !is_directory) {
1088                         entry->ae_flags &= ~(ACL_ENTRY_NO_PROPAGATE_INHERIT |
1089                         ACL_ENTRY_FILE_INHERIT | ACL_ENTRY_DIRECTORY_INHERIT |
1090                         ACL_ENTRY_INHERIT_ONLY);
1091                 }
1092
1093                 /*
1094                  * If the object is a directory and ACL_ENTRY_FILE_INHERIT
1095                  * is set, but ACL_ENTRY_DIRECTORY_INHERIT is not set, ensure
1096                  * that ACL_ENTRY_INHERIT_ONLY is set.
1097                  */
1098                 if (is_directory &&
1099                     (entry->ae_flags & ACL_ENTRY_FILE_INHERIT) &&
1100                     ((entry->ae_flags & ACL_ENTRY_DIRECTORY_INHERIT) == 0)) {
1101                         entry->ae_flags |= ACL_ENTRY_INHERIT_ONLY;
1102                 }
1103
1104                 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW &&
1105                     (entry->ae_flags & ACL_ENTRY_INHERIT_ONLY) == 0) {
1106                         /*
1107                          * Some permissions must never be inherited.
1108                          */
1109                         entry->ae_perm &= ~(ACL_WRITE_ACL | ACL_WRITE_OWNER |
1110                             ACL_WRITE_NAMED_ATTRS | ACL_WRITE_ATTRIBUTES);
1111
1112                         /*
1113                          * Others must be masked according to the file mode.
1114                          */
1115                         if ((mode & S_IRGRP) == 0)
1116                                 entry->ae_perm &= ~ACL_READ_DATA;
1117                         if ((mode & S_IWGRP) == 0)
1118                                 entry->ae_perm &=
1119                                     ~(ACL_WRITE_DATA | ACL_APPEND_DATA);
1120                         if ((mode & S_IXGRP) == 0)
1121                                 entry->ae_perm &= ~ACL_EXECUTE;
1122                 }
1123         }
1124 }
1125
1126 /*
1127  * Calculate inherited ACL in a manner compatible with PSARC/2010/029.
1128  * It's also being used to calculate a trivial ACL, by inheriting from
1129  * a NULL ACL.
1130  */
1131 static void
1132 acl_nfs4_compute_inherited_acl_psarc(const struct acl *parent_aclp,
1133     struct acl *aclp, mode_t mode, int file_owner_id, int is_directory)
1134 {
1135         acl_perm_t user_allow_first = 0, user_deny = 0, group_deny = 0;
1136         acl_perm_t user_allow, group_allow, everyone_allow;
1137
1138         KASSERT(aclp->acl_cnt == 0, ("aclp->acl_cnt == 0"));
1139
1140         user_allow = group_allow = everyone_allow = ACL_READ_ACL |
1141             ACL_READ_ATTRIBUTES | ACL_READ_NAMED_ATTRS | ACL_SYNCHRONIZE;
1142         user_allow |= ACL_WRITE_ACL | ACL_WRITE_OWNER | ACL_WRITE_ATTRIBUTES |
1143             ACL_WRITE_NAMED_ATTRS;
1144
1145         if (mode & S_IRUSR)
1146                 user_allow |= ACL_READ_DATA;
1147         if (mode & S_IWUSR)
1148                 user_allow |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
1149         if (mode & S_IXUSR)
1150                 user_allow |= ACL_EXECUTE;
1151
1152         if (mode & S_IRGRP)
1153                 group_allow |= ACL_READ_DATA;
1154         if (mode & S_IWGRP)
1155                 group_allow |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
1156         if (mode & S_IXGRP)
1157                 group_allow |= ACL_EXECUTE;
1158
1159         if (mode & S_IROTH)
1160                 everyone_allow |= ACL_READ_DATA;
1161         if (mode & S_IWOTH)
1162                 everyone_allow |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
1163         if (mode & S_IXOTH)
1164                 everyone_allow |= ACL_EXECUTE;
1165
1166         user_deny = ((group_allow | everyone_allow) & ~user_allow);
1167         group_deny = everyone_allow & ~group_allow;
1168         user_allow_first = group_deny & ~user_deny;
1169
1170         if (user_allow_first != 0)
1171                 _acl_append(aclp, ACL_USER_OBJ, user_allow_first,
1172                     ACL_ENTRY_TYPE_ALLOW);
1173         if (user_deny != 0)
1174                 _acl_append(aclp, ACL_USER_OBJ, user_deny,
1175                     ACL_ENTRY_TYPE_DENY);
1176         if (group_deny != 0)
1177                 _acl_append(aclp, ACL_GROUP_OBJ, group_deny,
1178                     ACL_ENTRY_TYPE_DENY);
1179
1180         if (parent_aclp != NULL)
1181                 acl_nfs4_inherit_entries(parent_aclp, aclp, mode,
1182                     file_owner_id, is_directory);
1183
1184         _acl_append(aclp, ACL_USER_OBJ, user_allow, ACL_ENTRY_TYPE_ALLOW);
1185         _acl_append(aclp, ACL_GROUP_OBJ, group_allow, ACL_ENTRY_TYPE_ALLOW);
1186         _acl_append(aclp, ACL_EVERYONE, everyone_allow, ACL_ENTRY_TYPE_ALLOW);
1187 }
1188
1189 #ifdef _KERNEL
1190 void
1191 acl_nfs4_compute_inherited_acl(const struct acl *parent_aclp,
1192     struct acl *child_aclp, mode_t mode, int file_owner_id,
1193     int is_directory)
1194 {
1195
1196         if (acl_nfs4_old_semantics)
1197                 acl_nfs4_compute_inherited_acl_draft(parent_aclp, child_aclp,
1198                     mode, file_owner_id, is_directory);
1199         else
1200                 acl_nfs4_compute_inherited_acl_psarc(parent_aclp, child_aclp,
1201                     mode, file_owner_id, is_directory);
1202 }
1203 #endif /* _KERNEL */
1204
1205 /*
1206  * Calculate trivial ACL in a manner compatible with PSARC/2010/029.
1207  * Note that this results in an ACL different from (but semantically
1208  * equal to) the "canonical six" trivial ACL computed using algorithm
1209  * described in draft-ietf-nfsv4-minorversion1-03.txt, 3.16.6.2.
1210  */
1211 static void
1212 acl_nfs4_trivial_from_mode(struct acl *aclp, mode_t mode)
1213 {
1214
1215         aclp->acl_cnt = 0;
1216         acl_nfs4_compute_inherited_acl_psarc(NULL, aclp, mode, -1, -1);
1217 }
1218
1219 #ifndef _KERNEL
1220 /*
1221  * This routine is used by libc to implement acl_strip_np(3)
1222  * and acl_is_trivial_np(3).
1223  */
1224 void
1225 acl_nfs4_trivial_from_mode_libc(struct acl *aclp, int mode, int canonical_six)
1226 {
1227
1228         aclp->acl_cnt = 0;
1229         if (canonical_six)
1230                 acl_nfs4_sync_acl_from_mode_draft(aclp, mode, -1);
1231         else
1232                 acl_nfs4_trivial_from_mode(aclp, mode);
1233 }
1234 #endif /* !_KERNEL */
1235
1236 #ifdef _KERNEL
1237 static int
1238 _acls_are_equal(const struct acl *a, const struct acl *b)
1239 {
1240         int i;
1241         const struct acl_entry *entrya, *entryb;
1242
1243         if (a->acl_cnt != b->acl_cnt)
1244                 return (0);
1245
1246         for (i = 0; i < b->acl_cnt; i++) {
1247                 entrya = &(a->acl_entry[i]);
1248                 entryb = &(b->acl_entry[i]);
1249
1250                 if (entrya->ae_tag != entryb->ae_tag ||
1251                     entrya->ae_id != entryb->ae_id ||
1252                     entrya->ae_perm != entryb->ae_perm ||
1253                     entrya->ae_entry_type != entryb->ae_entry_type ||
1254                     entrya->ae_flags != entryb->ae_flags)
1255                         return (0);
1256         }
1257
1258         return (1);
1259 }
1260
1261 /*
1262  * This routine is used to determine whether to remove extended attribute
1263  * that stores ACL contents.
1264  */
1265 int
1266 acl_nfs4_is_trivial(const struct acl *aclp, int file_owner_id)
1267 {
1268         int trivial;
1269         mode_t tmpmode = 0;
1270         struct acl *tmpaclp;
1271
1272         if (aclp->acl_cnt > 6)
1273                 return (0);
1274
1275         /*
1276          * Compute the mode from the ACL, then compute new ACL from that mode.
1277          * If the ACLs are identical, then the ACL is trivial.
1278          *
1279          * XXX: I guess there is a faster way to do this.  However, even
1280          *      this slow implementation significantly speeds things up
1281          *      for files that don't have non-trivial ACLs - it's critical
1282          *      for performance to not use EA when they are not needed.
1283          *
1284          * First try the PSARC/2010/029 semantics.
1285          */
1286         tmpaclp = acl_alloc(M_WAITOK | M_ZERO);
1287         acl_nfs4_sync_mode_from_acl(&tmpmode, aclp);
1288         acl_nfs4_trivial_from_mode(tmpaclp, tmpmode);
1289         trivial = _acls_are_equal(aclp, tmpaclp);
1290         if (trivial) {
1291                 acl_free(tmpaclp);
1292                 return (trivial);
1293         }
1294
1295         /*
1296          * Check if it's a draft-ietf-nfsv4-minorversion1-03.txt trivial ACL.
1297          */
1298         tmpaclp->acl_cnt = 0;
1299         acl_nfs4_sync_acl_from_mode_draft(tmpaclp, tmpmode, file_owner_id);
1300         trivial = _acls_are_equal(aclp, tmpaclp);
1301         acl_free(tmpaclp);
1302
1303         return (trivial);
1304 }
1305 #endif /* _KERNEL */
1306
1307 int
1308 acl_nfs4_check(const struct acl *aclp, int is_directory)
1309 {
1310         int i;
1311         const struct acl_entry *entry;
1312
1313         /*
1314          * The spec doesn't seem to say anything about ACL validity.
1315          * It seems there is not much to do here.  There is even no need
1316          * to count "owner@" or "everyone@" (ACL_USER_OBJ and ACL_EVERYONE)
1317          * entries, as there can be several of them and that's perfectly
1318          * valid.  There can be none of them too.  Really.
1319          */
1320
1321         if (aclp->acl_cnt > ACL_MAX_ENTRIES || aclp->acl_cnt <= 0)
1322                 return (EINVAL);
1323
1324         for (i = 0; i < aclp->acl_cnt; i++) {
1325                 entry = &(aclp->acl_entry[i]);
1326
1327                 switch (entry->ae_tag) {
1328                 case ACL_USER_OBJ:
1329                 case ACL_GROUP_OBJ:
1330                 case ACL_EVERYONE:
1331                         if (entry->ae_id != ACL_UNDEFINED_ID)
1332                                 return (EINVAL);
1333                         break;
1334
1335                 case ACL_USER:
1336                 case ACL_GROUP:
1337                         if (entry->ae_id == ACL_UNDEFINED_ID)
1338                                 return (EINVAL);
1339                         break;
1340
1341                 default:
1342                         return (EINVAL);
1343                 }
1344
1345                 if ((entry->ae_perm | ACL_NFS4_PERM_BITS) != ACL_NFS4_PERM_BITS)
1346                         return (EINVAL);
1347
1348                 /*
1349                  * Disallow ACL_ENTRY_TYPE_AUDIT and ACL_ENTRY_TYPE_ALARM for now.
1350                  */
1351                 if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW &&
1352                     entry->ae_entry_type != ACL_ENTRY_TYPE_DENY)
1353                         return (EINVAL);
1354
1355                 if ((entry->ae_flags | ACL_FLAGS_BITS) != ACL_FLAGS_BITS)
1356                         return (EINVAL);
1357
1358                 /* Disallow unimplemented flags. */
1359                 if (entry->ae_flags & (ACL_ENTRY_SUCCESSFUL_ACCESS |
1360                     ACL_ENTRY_FAILED_ACCESS))
1361                         return (EINVAL);
1362
1363                 /* Disallow flags not allowed for ordinary files. */
1364                 if (!is_directory) {
1365                         if (entry->ae_flags & (ACL_ENTRY_FILE_INHERIT |
1366                             ACL_ENTRY_DIRECTORY_INHERIT |
1367                             ACL_ENTRY_NO_PROPAGATE_INHERIT | ACL_ENTRY_INHERIT_ONLY))
1368                                 return (EINVAL);
1369                 }
1370         }
1371
1372         return (0);
1373 }