47#include <sys/sysproto.h>
48#include <sys/capsicum.h>
50#include <sys/kernel.h>
51#include <sys/malloc.h>
58#include <sys/filedesc.h>
60#include <sys/sysent.h>
63#include <security/audit/audit.h>
64#include <security/mac/mac_framework.h>
66CTASSERT(ACL_MAX_ENTRIES >= OLDACL_MAX_ENTRIES);
71 acl_type_t
type,
struct acl *aclp,
int follow);
73 acl_type_t
type,
int follow);
75 acl_type_t
type,
struct acl *aclp,
int follow);
77 acl_type_t
type,
const struct acl *aclp,
int follow);
78static int vacl_set_acl(
struct thread *td,
struct vnode *vp,
79 acl_type_t
type,
const struct acl *aclp);
80static int vacl_get_acl(
struct thread *td,
struct vnode *vp,
81 acl_type_t
type,
struct acl *aclp);
83 acl_type_t
type,
const struct acl *aclp);
90 if (source->acl_cnt < 0 || source->acl_cnt > OLDACL_MAX_ENTRIES)
93 bzero(dest,
sizeof(*dest));
95 dest->acl_cnt = source->acl_cnt;
96 dest->acl_maxcnt = ACL_MAX_ENTRIES;
98 for (i = 0; i < dest->acl_cnt; i++) {
99 dest->acl_entry[i].ae_tag = source->acl_entry[i].ae_tag;
100 dest->acl_entry[i].ae_id = source->acl_entry[i].ae_id;
101 dest->acl_entry[i].ae_perm = source->acl_entry[i].ae_perm;
112 if (source->acl_cnt > OLDACL_MAX_ENTRIES)
115 bzero(dest,
sizeof(*dest));
117 dest->acl_cnt = source->acl_cnt;
119 for (i = 0; i < dest->acl_cnt; i++) {
120 dest->acl_entry[i].ae_tag = source->acl_entry[i].ae_tag;
121 dest->acl_entry[i].ae_id = source->acl_entry[i].ae_id;
122 dest->acl_entry[i].ae_perm = source->acl_entry[i].ae_perm;
147 case ACL_TYPE_ACCESS_OLD:
148 case ACL_TYPE_DEFAULT_OLD:
149 error = copyin(user_acl, &old,
sizeof(old));
156 error = copyin(user_acl, kernel_acl,
sizeof(*kernel_acl));
157 if (kernel_acl->acl_maxcnt != ACL_MAX_ENTRIES)
172 case ACL_TYPE_ACCESS_OLD:
173 case ACL_TYPE_DEFAULT_OLD:
178 error = copyout(&old, user_acl,
sizeof(old));
182 error = fueword32((
char *)user_acl +
183 offsetof(
struct acl, acl_maxcnt), &am);
186 if (am != ACL_MAX_ENTRIES)
189 error = copyout(kernel_acl, user_acl,
sizeof(*kernel_acl));
205 case ACL_TYPE_ACCESS_OLD:
206 return (ACL_TYPE_ACCESS);
208 case ACL_TYPE_DEFAULT_OLD:
209 return (ACL_TYPE_DEFAULT);
229 const struct acl *aclp)
231 struct acl *inkernelacl;
235 AUDIT_ARG_VALUE(
type);
243 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
244 AUDIT_ARG_VNODE1(vp);
246 error = mac_vnode_check_setacl(td->td_ucred, vp,
type, inkernelacl);
269 struct acl *inkernelacl;
272 AUDIT_ARG_VALUE(
type);
273 inkernelacl =
acl_alloc(M_WAITOK | M_ZERO);
274 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
275 AUDIT_ARG_VNODE1(vp);
277 error = mac_vnode_check_getacl(td->td_ucred, vp,
type);
303 AUDIT_ARG_VALUE(
type);
307 vn_lock(vp, LK_EXCLUSIVE | LK_RETRY);
308 AUDIT_ARG_VNODE1(vp);
310 error = mac_vnode_check_deleteacl(td->td_ucred, vp,
type);
330 const struct acl *aclp)
332 struct acl *inkernelacl;
375 struct acl *aclp,
int follow)
380 NDINIT(&nd, LOOKUP, follow | AUDITVNODE1, UIO_USERSPACE,
path);
413 acl_type_t
type,
const struct acl *aclp,
int follow)
418 NDINIT(&nd, LOOKUP, follow | AUDITVNODE1, UIO_USERSPACE,
path);
437 AUDIT_ARG_FD(uap->filedes);
439 cap_rights_init_one(&rights, CAP_ACL_GET), &fp);
441 error =
vacl_get_acl(td, fp->f_vnode, uap->type, uap->aclp);
457 AUDIT_ARG_FD(uap->filedes);
459 cap_rights_init_one(&rights, CAP_ACL_SET), &fp);
461 error =
vacl_set_acl(td, fp->f_vnode, uap->type, uap->aclp);
489 acl_type_t
type,
int follow)
494 NDINIT(&nd, LOOKUP, follow, UIO_USERSPACE,
path);
513 AUDIT_ARG_FD(uap->filedes);
515 cap_rights_init_one(&rights, CAP_ACL_DELETE), &fp);
546 struct acl *aclp,
int follow)
551 NDINIT(&nd, LOOKUP, follow, UIO_USERSPACE,
path);
570 AUDIT_ARG_FD(uap->filedes);
572 cap_rights_init_one(&rights, CAP_ACL_CHECK), &fp);
574 error =
vacl_aclcheck(td, fp->f_vnode, uap->type, uap->aclp);
589 aclp->acl_maxcnt = ACL_MAX_ENTRIES;
device_property_type_t type
void *() malloc(size_t size, struct malloc_type *mtp, int flags)
void free(void *addr, struct malloc_type *mtp)
static int kern___acl_get_path(struct thread *td, const char *path, acl_type_t type, struct acl *aclp, int follow)
void acl_free(struct acl *aclp)
int sys___acl_get_fd(struct thread *td, struct __acl_get_fd_args *uap)
int sys___acl_get_link(struct thread *td, struct __acl_get_link_args *uap)
int sys___acl_aclcheck_fd(struct thread *td, struct __acl_aclcheck_fd_args *uap)
static int kern___acl_set_path(struct thread *td, const char *path, acl_type_t type, const struct acl *aclp, int follow)
int sys___acl_aclcheck_link(struct thread *td, struct __acl_aclcheck_link_args *uap)
int sys___acl_set_file(struct thread *td, struct __acl_set_file_args *uap)
static int vacl_delete(struct thread *td, struct vnode *vp, acl_type_t type)
static int acl_copyout(const struct acl *kernel_acl, void *user_acl, acl_type_t type)
int sys___acl_aclcheck_file(struct thread *td, struct __acl_aclcheck_file_args *uap)
int sys___acl_set_link(struct thread *td, struct __acl_set_link_args *uap)
MALLOC_DEFINE(M_ACL, "acl", "Access Control Lists")
int sys___acl_set_fd(struct thread *td, struct __acl_set_fd_args *uap)
int sys___acl_get_file(struct thread *td, struct __acl_get_file_args *uap)
int acl_copy_oldacl_into_acl(const struct oldacl *source, struct acl *dest)
static int acl_copyin(const void *user_acl, struct acl *kernel_acl, acl_type_t type)
int sys___acl_delete_link(struct thread *td, struct __acl_delete_link_args *uap)
static int kern___acl_delete_path(struct thread *td, const char *path, acl_type_t type, int follow)
static int vacl_get_acl(struct thread *td, struct vnode *vp, acl_type_t type, struct acl *aclp)
int acl_copy_acl_into_oldacl(const struct acl *source, struct oldacl *dest)
int sys___acl_delete_fd(struct thread *td, struct __acl_delete_fd_args *uap)
static int vacl_set_acl(struct thread *td, struct vnode *vp, acl_type_t type, const struct acl *aclp)
static int vacl_aclcheck(struct thread *td, struct vnode *vp, acl_type_t type, const struct acl *aclp)
static int acl_type_unold(int type)
struct acl * acl_alloc(int flags)
CTASSERT(ACL_MAX_ENTRIES >=OLDACL_MAX_ENTRIES)
static int kern___acl_aclcheck_path(struct thread *td, const char *path, acl_type_t type, struct acl *aclp, int follow)
int sys___acl_delete_file(struct thread *td, struct __acl_delete_file_args *uap)
void() NDFREE(struct nameidata *ndp, const u_int flags)
int namei(struct nameidata *ndp)
int getvnode(struct thread *td, int fd, cap_rights_t *rightsp, struct file **fpp)
int vn_start_write(struct vnode *vp, struct mount **mpp, int flags)
void vn_finished_write(struct mount *mp)