summaryrefslogtreecommitdiffstats
path: root/sys/kern/vfs_extattr.c
Commit message (Collapse)AuthorAgeFilesLines
* Revert r210225 - turns out I was wrong; the "/*-" is not license-onlytrasz2010-07-181-3/+3
| | | | | | | thing; it's also used to indicate that the comment should not be automatically rewrapped. Explained by: cperciva@
* The "/*-" comment marker is supposed to denote copyrights. Remove non-copyrighttrasz2010-07-181-3/+3
| | | | occurences from sys/sys/ and sys/kern/.
* Replace AUDIT_ARG() with variable argument macros with a set more morerwatson2009-06-271-28/+28
| | | | | | | | | | | | | | specific macros for each audit argument type. This makes it easier to follow call-graphs, especially for automated analysis tools (such as fxr). In MFC, we should leave the existing AUDIT_ARG() macros as they may be used by third-party kernel modules. Suggested by: brooks Approved by: re (kib) Obtained from: TrustedBSD Project MFC after: 1 week
* Move "options MAC" from opt_mac.h to opt_global.h, as it's now in GENERICrwatson2009-06-051-2/+0
| | | | | | | | and used in a large number of files, but also because an increasing number of incorrect uses of MAC calls were sneaking in due to copy-and-paste of MAC-aware code without the associated opt_mac.h include. Discussed with: pjd
* Remove the thread argument from the FSD (File-System Dependent) parts ofattilio2009-05-111-1/+1
| | | | | | | | | | | | | | | | | the VFS. Now all the VFS_* functions and relating parts don't want the context as long as it always refers to curthread. In some points, in particular when dealing with VOPs and functions living in the same namespace (eg. vflush) which still need to be converted, pass curthread explicitly in order to retain the old behaviour. Such loose ends will be fixed ASAP. While here fix a bug: now, UFS_EXTATTR can be compiled alone without the UFS_EXTATTR_AUTOSTART option. VFS KPI is heavilly changed by this commit so thirdy parts modules needs to be recompiled. Bump __FreeBSD_version in order to signal such situation.
* Remove VOP_LEASE and supporting functions. This hasn't been used sincerwatson2009-04-101-4/+0
| | | | | | | | | | | | | | the removal of NQNFS, but was left in in case it was required for NFSv4. Since our new NFSv4 client and server can't use it for their requirements, GC the old mechanism, as well as other unused lease- related code and interfaces. Due to its impact on kernel programming and binary interfaces, this change should not be MFC'd. Proposed by: jeff Reviewed by: jeff Discussed with: rmacklem, zach loafman @ isilon
* Remove 'uio' argument from MAC Framework and MAC policy entry points forrwatson2009-03-081-2/+2
| | | | | | | | | extended attribute get/set; in the case of get an uninitialized user buffer was passed before the EA was retrieved, making it of relatively little use; the latter was simply unused by any policies. Obtained from: TrustedBSD Project Sponsored by: Google, Inc.
* Do not call namei() while having another user-controlled vnodekib2009-01-081-18/+31
| | | | | | | | | | | | | | | locked. Lookup could attempt to recursively lock that vnode. Do not call vn_start_write(V_WAIT) while vnode is locked, this may result in a deadlock with suspension. vfs_busy() the mountpoint before dropping vnode lock for vnode that was used to look up the mountpoint, to prevent unmount in between. Reported and tested by: pho Reviewed by: rwatson MFC after: 3 weeks
* Add the support for the AT_FDCWD and fd-relative name lookups to thekib2008-03-311-0/+1
| | | | | | | | | namei(9). Based on the submission by rdivacky, sponsored by Google Summer of Code 2007 Reviewed by: rwatson, rdivacky Tested by: pho
* VOP_LOCK1() (and so VOP_LOCK()) and VOP_UNLOCK() are only used inattilio2008-01-131-4/+4
| | | | | | | | | | | conjuction with 'thread' argument passing which is always curthread. Remove the unuseful extra-argument and pass explicitly curthread to lower layer functions, when necessary. KPI results broken by this change, which should affect several ports, so version bumping and manpage update will be further committed. Tested by: kris, pho, Diego Sardina <siarodx at gmail dot com>
* vn_lock() is currently only used with the 'curthread' passed as argument.attilio2008-01-101-4/+4
| | | | | | | | | | | | | | | | Remove this argument and pass curthread directly to underlying VOP_LOCK1() VFS method. This modify makes the code cleaner and in particular remove an annoying dependence helping next lockmgr() cleanup. KPI results, obviously, changed. Manpage and FreeBSD_version will be updated through further commits. As a side note, would be valuable to say that next commits will address a similar cleanup about VFS methods, in particular vop_lock1 and vop_unlock. Tested by: Diego Sardina <siarodx at gmail dot com>, Andrea Di Pasquale <whyx dot it at gmail dot com>
* Merge first in a series of TrustedBSD MAC Framework KPI changesrwatson2007-10-241-4/+4
| | | | | | | | | | | | | | | | | | | | | | | from Mac OS X Leopard--rationalize naming for entry points to the following general forms: mac_<object>_<method/action> mac_<object>_check_<method/action> The previous naming scheme was inconsistent and mostly reversed from the new scheme. Also, make object types more consistent and remove spaces from object types that contain multiple parts ("posix_sem" -> "posixsem") to make mechanical parsing easier. Introduce a new "netinet" object type for certain IPv4/IPv6-related methods. Also simplify, slightly, some entry point names. All MAC policy modules will need to be recompiled, and modules not updates as part of this commit will need to be modified to conform to the new KPI. Sponsored by: SPARTA (original patches against Mac OS X) Obtained from: TrustedBSD Project, Apple Computer
* Update comments to reflect changes in the extattrctl() code.rwatson2006-12-231-12/+8
| | | | | | Clean up comment formatting. Obtained from: TrustedBSD Project
* Following a repo-copy of vfs_syscalls.c to vfs_extattr.c, removerwatson2006-12-231-4314/+7
| | | | | | | | | | | | non-extattr functions from vfs_extattr.c, and extattr functions from vfs_syscalls.c. Change copyright/license on vfs_extattr.c to my copyright/license on the extended attribute implementation (from extattr.h). Clean up includes a bit. Obtained from: TrustedBSD Project
* Sweep kernel replacing suser(9) calls with priv(9) calls, assigningrwatson2006-11-061-29/+39
| | | | | | | | | | | | | specific privilege names to a broad range of privileges. These may require some future tweaking. Sponsored by: nCircle Network Security, Inc. Obtained from: TrustedBSD Project Discussed on: arch@ Reviewed (at least in part) by: mlaier, jmg, pjd, bde, ceri, Alex Lyashkov <umka at sevcity dot net>, Skip Ford <skip dot ford at verizon dot net>, Antoine Brodin <antoine dot brodin at laposte dot net>
* The attempt to rename "." with MAC framework compiled in would cause attemptkib2006-10-261-1/+2
| | | | | | | | | to twice unlock the vnode. Check that ni_vp and ni_dvp are different before doing second unlock. Reviewed by: rwatson Approved by: pjd (mentor) MFC after: 1 week
* Complete break-out of sys/sys/mac.h into sys/security/mac/mac_framework.hrwatson2006-10-221-1/+1
| | | | | | | | | | | | | begun with a repo-copy of mac.h to mac_framework.h. sys/mac.h now contains the userspace and user<->kernel API and definitions, with all in-kernel interfaces moved to mac_framework.h, which is now included across most of the kernel instead. This change is the first step in a larger cleanup and sweep of MAC Framework interfaces in the kernel, and will not be MFC'd. Obtained from: TrustedBSD Project Sponsored by: SPARTA
* Add mnt_noasync counter to better handle interleaved calls to nmount(),tegge2006-09-261-4/+6
| | | | | | sync() and sync_fsync() without losing MNT_ASYNC. Add MNTK_ASYNC flag which is set only when MNT_ASYNC is set and mnt_noasync is zero, and check that flag instead of MNT_ASYNC before initiating async io.
* Use mount interlock to protect all changes to mnt_flag and mnt_kern_flag.tegge2006-09-261-0/+4
| | | | | This eliminates a race where MNT_UPDATE flag could be lost when nmount() raced against sync(), sync_fsync() or quotactl().
* There is no need to set 'sp' to NULL anymore.pjd2006-09-201-1/+0
|
* Copy stat information from mount structure before it can change identity.tegge2006-09-201-2/+2
|
* Declare security and security.bsd sysctl hierarchies in sysctl.h alongrwatson2006-09-171-2/+0
| | | | | | | | with other commonly used sysctl name spaces, rather than declaring them all over the place. MFC after: 1 month Sponsored by: nCircle Network Security, Inc.
* Fix some bugs in the previous revision (1.419). Don't perform extrajhb2006-08-021-9/+4
| | | | | | | | | | | | vfs_rel() on the mountpoint if the MAC checks fail in kern_statfs() and kern_fstatfs(). Similarly, don't perform an extra vfs_rel() if we get a doomed vnode in kern_fstatfs(), and handle the case of mp being NULL (for some doomed vnodes) by conditionalizing the vfs_rel() in kern_fstatfs() on mp != NULL. CID: 1517 Found by: Coverity Prevent (tm) (kern_fstatfs()) Pointy hat to: jhb
* Hold the reference on the mountpoint slightly longer in kern_statfs() andjhb2006-07-271-2/+2
| | | | | | | | kern_fstatfs() so that it is still held when prison_enforce_statfs() is called (since that function likes to poke and prod at the mountpoint structure). MFC after: 3 days
* Call change_dir() instead of duplicating the code in fchdir().jhb2006-07-191-8/+1
|
* - Add conditional VFS Giant locking to getdents_common() (linux ABIs),jhb2006-07-111-2/+11
| | | | | | | | ibcs2_getdents(), ibcs2_read(), ogetdirentries(), svr4_sys_getdents(), and svr4_sys_getdents64() similar to that in getdirentries(). - Mark ibcs2_getdents(), ibcs2_read(), linux_getdents(), linux_getdents64(), linux_readdir(), ogetdirentries(), svr4_sys_getdents(), and svr4_sys_getdents64() MPSAFE.
* Audit the remaining parameters to the extattr system calls. Generatewsalamon2006-07-061-0/+28
| | | | | | | the audit records for those calls. Obtained from: TrustedBSD Project Approved by: rwatson (mentor)
* Audit command, uid arguments for quotactl().rwatson2006-06-051-0/+4
| | | | | | | | Audit the mode argument to mkfifo(). Audit the target path passed to symlink(). Submitted by: wsalamon Obtained from: TrustedBSD Project
* - Release the references acquired by VOP_GETWRITEMOUNT and vfs_getvfs().jeff2006-03-311-13/+12
| | | | | | Discussed with: tegge Tested by: kris Sponsored by: Isilon Systems, Inc.
* Change vn_open() to honor the MPSAFE flag in the passed in nameidata objectjhb2006-03-281-1/+1
| | | | | | | | and use that instead of testing fdidx against -1 to determine if it should release Giant if Giant was locked due to the requested file residing on a non-MPSAFE VFS. Discussed with: jeff
* - Remove explicit calls to lock and unlock Giant and replace them withjeff2006-03-211-83/+66
| | | | | | | | VFS_LOCK_GIANT/VFS_UNLOCK_GIANT calls. This completely removes Giant acquisition in the syscall path for ffs. Bug fix to kern_fhstatfs from: Todd Miller <Todd.Miller@sparta.com> Sponsored by: Isilon Systems, Inc.
* use strlcpy in cvtstatfs and copy_statfs instead of bcopy to ensureps2006-03-041-4/+4
| | | | | | the copied strings are properly terminated. bzero the statfs32 struct in copy_statfs.
* Don't truncate f_mntfromname & f_mntonname to 16 characters whenps2006-03-031-2/+2
| | | | | translating statfs into ostatfs. This allows 4.x binaries making statfs calls to work on 6.x.
* - Use vfs_ref/rel to protect a mountpoint from going away while VFS_STATFSjeff2006-02-231-10/+29
| | | | | | | is being called. Be sure to grab the ref before we unlock the vnode to prevent the mount from disappearing. Tested by: kris
* Add pathname and/or vnode argument auditing for the following system calls:wsalamon2006-02-221-50/+129
| | | | | | | | | | | | | | | | | | quotactl, statfs, fstatfs, fchdir, chdir, chroot, open, mknod, mkfifo, link, symlink, undelete, unlink, access, eaccess, stat, lstat, pathconf, readlink, chflags, lchflags, fchflags, chmod, lchmod, fchmod, chown, lchown, fchown, utimes, lutimes, futimes, truncate, ftruncate, fsync, rename, mkdir, rmdir, getdirentries, revoke, lgetfh, getfh, extattrctl, extattr_set_file, extattr_set_link, extattr_get_file, extattr_get_link, extattr_delete_file, extattr_delete_link, extattr_list_file, extattr_list_link. In many cases the pathname and vnode auditing is done within namei lookup instead of directly in the system call. Audit the remaining arguments to these system calls: fstatfs, fchdir, open, mknod, chflags, lchflags, fchflags, chmod, lchmod, fchmod, chown, lchown, fchown, futimes, ftruncate, fsync, mkdir, getdirentries.
* - Revert r1.406 until a solution can be found that doesn't break nfs. Thejeff2006-02-221-28/+21
| | | | | | | | statfs handler in nfs will lock vnodes which may lead to deadlock or recursion. Found by: kris Pointy hat to: me
* - Hold the vnode used in the statfs related functions until we're done withjeff2006-02-221-21/+28
| | | | | | | | the VFS_STATFS call to prevent the mount from disappearing while we're stating. - Convert these routines to use MPSAFE namei semantics. MFC After: 1 week
* Add a kern_eaccess() function and use it to implement xenix_eaccess()jhb2006-02-061-3/+9
| | | | | | rather than kern_access(). Suggested by: rwatson
* - Don't check v_mount for NULL to determine if a vnode has been recycled.jeff2006-02-061-2/+4
| | | | | | | Use the more appropriate VI_DOOMED flag instead. Sponsored by: Isilon Systems, Inc. MFC After: 1 week
* In fchdir(), Giant must be separately acquired and dropped if the oldrwatson2006-02-031-0/+2
| | | | | | | | vnode is from a file system that is not MPSAFE, as vrele() expects Giant to be held when it is called on a non-MPSAFE vnode. Spotted by: kris Tested by: glebius
* - chroot and chdir need to lock giant as appropriate for the outgoing vpjeff2006-02-011-0/+5
| | | | | | | as well as the new vp. Sponsored by: Isilon Systems, Inc. MFC After: 3 days
* - Reorder calls to vrele() after calls to vput() when the vrele is ajeff2006-02-011-11/+11
| | | | | | | | | | | | directory. vrele() may lock the passed vnode, which in these cases would give an invalid lock order of child -> parent. These situations are deadlock prone although do not typically deadlock because the vrele is typically not releasing the last reference to the vnode. Users of vrele must consider it as a call to vn_lock() and order it appropriately. MFC After: 1 week Sponsored by: Isilon Systems, Inc. Tested by: kkenn
* Tweak previous vfs_lookup.c commit to return an EINVAL error fromtruckman2006-01-221-1/+1
| | | | | | | | | | | lookup() instead of EPERM when a DELETE or RENAME operation is attempted on "..". In kern_unlink(), remap EINVAL errors returned from namei() to EPERM to match existing (and POSIX required) behaviour. Discussed with: bde MFC after: 3 days
* Fix style bug.dds2006-01-041-2/+2
| | | | Prompted by: bde
* Replace tv_usec normalization with the return of EINVAL.dds2006-01-041-24/+6
| | | | | | | This addresses two objections to the previous behavior, and unbreaks the alpha tinderbox build. TODO: update the utimes(2) man page.
* Normalize the tv_usec part of the utimes(2) arguments to ensuredds2006-01-031-3/+24
| | | | | | | | | | | that a file's atime and mtime are only set to correct fractional second values (0-999999000ns with the current interface). Prior to this change users could create files with values outside that range. Moreover, on 32-bit machines tv_usec offsets larger than 4.3s would result in an unnormalized AND wrong timestamp value, due to overflow. MFC after: 1 week
* Reduce Giant scope a bit, as fdrop() is believed to be MPSAFE.pjd2005-12-201-9/+7
| | | | | | | | The purpose of this change is consistency (not performance improvement:)), as it was hard to tell if fdrop() is MPSAFE or not when I saw it sometimes under the Giant and sometimes without it. Glanced at by: ssouhlal, kan
* Implement new world order in VFS locking for extended attributes. This willcsjp2005-09-241-29/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | remove the unconditional acquisition of Giant for extended attribute related operations. If the file system is set as being MP safe and debug.mpsafevfs is 1, do not pickup Giant. Mark the following system calls as being MP safe so we no longer pickup Giant in the system call handler: o extattrctl o extattr_set_file o extattr_get_file o extattr_delete_file o extattr_set_fd o extattr_get_fd o extattr_delete_fd o extattr_set_link o extattr_get_link o extattr_delete_link o extattr_list_file o extattr_list_link o extattr_list_fd -Pass MPSAFE flags to namei(9) lookup and introduce vfslocked variable which will keep track of any Giant acquisitions. -Wrap any fd operations which manipulate vnodes in VFS_{UN}LOCK_GIANT -Drop VFS_ASSERT_GIANT into function which operate on vnodes to ensure that we are sufficiently protected. I've tested these changes with various TrustedBSD MAC policies which use extended attribute a lot on SMP and UP systems (thanks to Scott Long for making some SMP hardware available to me for testing). Discussed with: jeff Requested by: jhb, rwatson
* Improve the MP safeness associated with the creation of symboliccsjp2005-09-151-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | links and the execution of ELF binaries. Two problems were found: 1) The link path wasn't tagged as being MP safe and thus was not properly protected. 2) The ELF interpreter vnode wasnt being locked in namei(9) and thus was insufficiently protected. This commit makes the following changes: -Sets the MPSAFE flag in NDINIT for symbolic link paths -Sets the MPSAFE flag in NDINIT and introduce a vfslocked variable which will be used to instruct VFS_UNLOCK_GIANT to unlock Giant if it has been picked up. -Drop in an assertion into vfs_lookup which ensures that if the MPSAFE flag is NOT set, that we have picked up giant. If not panic (if WITNESS compiled into the kernel). This should help us find conditions where vnode operations are in-sufficiently protected. This is a RELENG_6 candidate. Discussed with: jeff MFC after: 4 days
* In case of mac_check_vnode_rename_from() or vn_start_write() failure,pjd2005-09-011-1/+2
| | | | | | | vn_finished_write() should not be called. Reviewed by: ssouhlal MFC after: 3 days
OpenPOWER on IntegriCloud