summaryrefslogtreecommitdiffstats
path: root/sys/kern/vfs_extattr.c
Commit message (Collapse)AuthorAgeFilesLines
* Fix a case in kern_rename() where a vn_finished_write() call wasiedowse2002-10-271-2/+2
| | | | | | | | missed. This bug has been present since the vn_start_write() and vn_finished_write() calls were first added in revision 1.159. When the case is triggered, any attempts to create snapshots on the filesystem will deadlock and also prevent further write activity on that filesystem.
* Change the way support for asynchronous I/O is indicated to applicationswollman2002-10-271-1/+14
| | | | | | | | | | to conform to 1003.1-2001. Make it possible for applications to actually tell whether or not asynchronous I/O is supported. Since FreeBSD's aio implementation works on all descriptor types, don't call down into file or vnode ops when [f]pathconf() is asked about _PC_ASYNC_IO; this avoids the need for every file and vnode op to know about it.
* Hook up most of the MAC entry points relating to file/directory/noderwatson2002-10-191-2/+68
| | | | | | | | | | | | | | | | | | | creation, deletion, and rename. There are one or two other stray cases I'll catch in follow-up commits (such as unix domain socket creation); this permits MAC policy modules to limit the ability to perform these operations based on existing UNIX credential / vnode attributes, extended attributes, and security labels. In the rename case using MAC, we now have to lock the from directory and file vnodes for the MAC check, but this is done only in the MAC case, and the locks are immediately released so that the remainder of the rename implementation remains the same. Because the create check takes a vattr to know object type information, we now initialize additional fields in the VATTR passed to VOP_SYMLINK() in the MAC case. Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Incremental style improvements: more consistently avoid assignmentsrwatson2002-10-101-18/+31
| | | | | | | in conditionals; remove some excess vertical whitespace; remove a bug in the return handling of the delete_vp() case for MAC. Spotted by: bde
* Explore new heights in alphabetization for _file and _fd variations onrwatson2002-10-101-60/+60
| | | | the extended attribute system calls.
* Implement extattr_{delete,get,set}_link() system calls: extended attributerwatson2002-10-091-0/+90
| | | | | | | operations that do not follow links. Sync to MAC tree. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Add back a fdrop() call at the end of kern_open() that got lost iniedowse2002-10-071-0/+1
| | | | | | | | | revision 1.218. This bug caused a "struct file" reference to be leaked if VOP_ADVLOCK(), vn_start_write(), or mac_check_vnode_write() failed during the open operation. PR: kern/43739 Reported by: Arne Woerner <woerner@mediabase-gmbh.de>
* Merge support for mac_check_vnode_link(), a MAC framework/policy entryrwatson2002-10-051-1/+6
| | | | | | | | point that instruments the creation of hard links. Policy implementations to follow. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Fix mis-indentation.phk2002-10-021-1/+1
| | | | Spotted by: FlexeLint
* - Properly lock v_vflags in getdirents().jeff2002-09-251-4/+14
|
* VOP_FSYNC() requires that it's vnode argument be locked, which nfs_link()truckman2002-09-191-1/+3
| | | | | | | | | | wasn't doing. Rather than just lock and unlock the vnode around the call to VOP_FSYNC(), implement rwatson's suggestion to lock the file vnode in kern_link() before calling VOP_LINK(), since the other filesystems also locked the file vnode right away in their link methods. Remove the locking and and unlocking from the leaf filesystem link methods. Reviewed by: rwatson, bde (except for the unionfs_link() changes)
* vfs_syscalls.c:bde2002-09-101-7/+3
| | | | | | | | | | | | | | | | | | | | | | Changed rename(2) to follow the letter of the POSIX spec. POSIX requires rename() to have no effect if its args "resolve to the same existing file". I think "file" can only reasonably be read as referring to the inode, although the rationale and "resolve" seem to say that sameness is at the level of (resolved) directory entries. ext2fs_vnops.c, ufs_vnops.c: Replaced code that gave the historical BSD behaviour of removing one link name by checks that this code is now unreachable. This fixes some races. All vnodes needed to be unlocked for the removal, and locking at another level using something like IN_RENAME was not even attempted, so it was possible for rename(x, y) to return with both x and y removed even without any unlink(2) syscalls (one process can remove x using rename(x, y) and another process can remove y using rename(y, x)). Prodded by: alfred MFC after: 8 weeks PR: 42617
* Split out a number of mostly VFS and signal related syscalls intoiedowse2002-09-011-82/+214
| | | | | | | | | | | | a kernel-internal kern_*() version and a wrapper that is called via the syscall vector table. For paths and structure pointers, the internal version either takes a uio_seg parameter or requires the caller to copyin() the data to kernel memory as appropiate. This will permit emulation layers to use these syscalls without having to copy out translated arguments to the stack gap. Discussed on: -arch Review/suggestions: bde, jhb, peter, marcel
* - Hold the vnode lock across unlink() so that the v_vflag check is safe.jeff2002-08-211-15/+20
| | | | - Fix the long broken error handling for VV_ROOT and VDIR.
* Pass active_cred and file_cred into the MAC framework explicitlyrwatson2002-08-191-4/+11
| | | | | | | | | | | for mac_check_vnode_{poll,read,stat,write}(). Pass in fp->f_cred when calling these checks with a struct file available. Otherwise, pass NOCRED. All currently MAC policies use active_cred, but could now offer the cached credential semantic used for the base system security model. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Break out mac_check_vnode_op() into three seperate checks:rwatson2002-08-191-8/+4
| | | | | | | | | | mac_check_vnode_poll(), mac_check_vnode_read(), mac_check_vnode_write(). This improves the consistency with other existing vnode checks, and allows policies to avoid implementing switch statements to determine what operations they do and do not want to authorize. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Make similar changes to fo_stat() and fo_poll() as made earlier torwatson2002-08-161-7/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | fo_read() and fo_write(): explicitly use the cred argument to fo_poll() as "active_cred" using the passed file descriptor's f_cred reference to provide access to the file credential. Add an active_cred argument to fo_stat() so that implementers have access to the active credential as well as the file credential. Generally modify callers of fo_stat() to pass in td->td_ucred rather than fp->f_cred, which was redundantly provided via the fp argument. This set of modifications also permits threads to perform these operations on behalf of another thread without modifying their credential. Trickle this change down into fo_stat/poll() implementations: - badfo_poll(), badfo_stat(): modify/add arguments. - kqueue_poll(), kqueue_stat(): modify arguments. - pipe_poll(), pipe_stat(): modify/add arguments, pass active_cred to MAC checks rather than td->td_ucred. - soo_poll(), soo_stat(): modify/add arguments, pass fp->f_cred rather than cred to pru_sopoll() to maintain current semantics. - sopoll(): moidfy arguments. - vn_poll(), vn_statfile(): modify/add arguments, pass new arguments to vn_stat(). Pass active_cred to MAC and fp->f_cred to VOP_POLL() to maintian current semantics. - vn_close(): rename cred to file_cred to reflect reality while I'm here. - vn_stat(): Add active_cred and file_cred arguments to vn_stat() and consumers so that this distinction is maintained at the VFS as well as 'struct file' layer. Pass active_cred instead of td->td_ucred to MAC and to VOP_GETATTR() to maintain current semantics. - fifofs: modify the creation of a "filetemp" so that the file credential is properly initialized and can be used in the socket code if desired. Pass ap->a_td->td_ucred as the active credential to soo_poll(). If we teach the vnop interface about the distinction between file and active credentials, we would use the active credential here. Note that current inconsistent passing of active_cred vs. file_cred to VOP's is maintained. It's not clear why GETATTR would be authorized using active_cred while POLL would be authorized using file_cred at the file system level. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* - Replace v_flag with v_iflag and v_vflagjeff2002-08-041-4/+7
| | | | | | | | | | | | | | | - v_vflag is protected by the vnode lock and is used when synchronization with VOP calls is needed. - v_iflag is protected by interlock and is used for dealing with vnode management issues. These flags include X/O LOCK, FREE, DOOMED, etc. - All accesses to v_iflag and v_vflag have either been locked or marked with mp_fixme's. - Many ASSERT_VOP_LOCKED calls have been added where the locking was not clear. - Many functions in vfs_subr.c were restructured to provide for stronger locking. Idea stolen from: BSD/OS
* Introduce support for Mandatory Access Control and extensiblerwatson2002-08-011-1/+14
| | | | | | | | | | kernel access control. Invoke appropriate MAC framework entry points to authorize readdir() operations in the native ABI. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Include file cleanup; mac.h and malloc.h at one point had orderingrwatson2002-08-011-1/+1
| | | | | | relationship requirements, and no longer do. Reminded by: bde
* Introduce support for Mandatory Access Control and extensiblerwatson2002-08-011-10/+95
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | kernel access control. Invoke appropriate MAC entry points to authorize the following operations: truncate on open() (write) access() (access) readlink() (readlink) chflags(), lchflags(), fchflags() (setflag) chmod(), fchmod(), lchmod() (setmode) chown(), fchown(), lchown() (setowner) utimes(), lutimes(), futimes() (setutimes) truncate(), ftrunfcate() (write) revoke() (revoke) fhopen() (open) truncate on fhopen() (write) extattr_set_fd, extattr_set_file() (setextattr) extattr_get_fd, extattr_get_file() (getextattr) extattr_delete_fd(), extattr_delete_file() (setextattr) These entry points permit MAC policies to enforce a variety of protections on vnodes. More vnode checks to come, especially in non-native ABIs. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-08-011-0/+12
| | | | | | | | | | kernel access control. Instrument chdir() and chroot()-related system calls to invoke appropriate MAC entry points to authorize the two operations. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Improve formatting and variable use consistency in extattr systemrwatson2002-08-011-3/+2
| | | | | | | | calls. Submitted by: green Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Simplify the logic to enter VFS_EXTATTRCTL().rwatson2002-08-011-7/+2
| | | | | Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-07-311-0/+23
| | | | | | | | | | | | | kernel access control. Implement MAC framework access control entry points relating to operations on mountpoints. Currently, this consists only of access control on mountpoint listing using the various statfs() variations. In the future, it might also be desirable to implement checks on mount() and unmount(). Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* When referencing nd_cnp after namei(), always pass SAVENAME intorwatson2002-07-301-5/+9
| | | | | | | | NDINIT() operation flags. Submitted by: green Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Set VAPPEND in open mode when O_APPEND is specified as an argument torwatson2002-07-221-0/+2
| | | | | | | | | | | open() of fhopen(). Currently this has no actual affect due to the treatment of VAPPEND in vaccess() and vaccess_acl() as a subset of VWRITE, but when MAC comes in, MAC will distinguish the two. Note: if any file systems are cutting their own permission models, they may wish to now take this into account. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Change utimes to set the file creation time (for filesystems thatmckusick2002-07-171-6/+15
| | | | | | | | support creation times such as UFS2) to the value of the modification time if the value of the modification time is older than the current creation time. See utimes(2) for further details. Sponsored by: DARPA & NAI Labs.
* Change the name of st_createtime to st_birthtime. This change ismckusick2002-07-161-1/+1
| | | | | | | made to reduce confusion between st_ctime and st_createtime. Submitted by: Eric Allman <eric@sendmail.org> Sponsored by: DARPA & NAI Labs.
* - Change chroot_refuse_vdir_fds() to require that the passed in structjhb2002-07-131-16/+18
| | | | | | | | | filedesc is already locked rather than having chroot() unlock the filedesc so chroot_refuse_vdir_fds() can immediately relock it. - Reorder chroot() a bitso that we do the namei lookup before checking the process's struct filedesc. This closes at least one potential race and allows us to only acquire the filedsec lock once in chroot(). - Push down Giant slightly into chroot().
* Move every code related to mount(2) in a new file, vfs_mount.c.mux2002-07-021-1042/+0
| | | | | | | | | | The file vfs_conf.c which was dealing with root mounting has been repo-copied into vfs_mount.c to preserve history. This makes nmount related development easier, and help reducing the size of vfs_syscalls.c, which is still an enormous file. Reviewed by: rwatson Repo-copy by: peter
* Use indirect function pointer hooks instead of #ifdef SOFTUPDATESiedowse2002-07-011-5/+4
| | | | | | | | | direct calls for the two places where the kernel calls into soft updates code. Set up the hooks in softdep_initialize() and NULL them out in softdep_uninitialize(). This change allows soft updates to function correctly when ufs is loaded as a module. Reviewed by: mckusick
* Remove unneeded casts to caddr_t.alfred2002-06-281-31/+31
|
* In vn_mkdir(), use vrele() instead of vput() on the parent directoryiedowse2002-06-281-1/+9
| | | | | | | | | | | vnode in the case that the target exists and is the same vnode as the parent (i.e. "mkdir ."). The namei() call does not leave the vnode locked in this case even though you might expect it to. This bug was mostly harmless in practice because unlocking an already unlocked vnode currently does not trigger any panics or warnings. Reviewed by: jeff
* Use proper size in bzero of stat structure.mckusick2002-06-241-1/+1
| | | | | Submitted by: Jake Burkholder <jake@locore.ca> Sponsored by: DARPA & NAI Labs.
* This patch fixes a size problem with the stat structure formckusick2002-06-221-1/+1
| | | | | | | | | 64-bit architectures that was introduced in the UFS2 code merge two days ago. The stat structure change that caused the problem was the addition of the file create time. Submitted by: Bruce Evans <bde@zeta.org.au> Sponsored by: DARPA & NAI Labs.
* o Remove the initialization of unused fields in the structmux2002-06-221-25/+5
| | | | | | | | | | uio now that we don't use uiomove() anymore. o Enforce stricter checks on the length of the iov's in nmount(2) since we now malloc() them individually and corrupted iov's could make the kernel crash in malloc() with "kmem_map too small". Reviewed by: phk
* This commit adds basic support for the UFS2 filesystem. The UFS2mckusick2002-06-211-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | filesystem expands the inode to 256 bytes to make space for 64-bit block pointers. It also adds a file-creation time field, an ability to use jumbo blocks per inode to allow extent like pointer density, and space for extended attributes (up to twice the filesystem block size worth of attributes, e.g., on a 16K filesystem, there is space for 32K of attributes). UFS2 fully supports and runs existing UFS1 filesystems. New filesystems built using newfs can be built in either UFS1 or UFS2 format using the -O option. In this commit UFS1 is the default format, so if you want to build UFS2 format filesystems, you must specify -O 2. This default will be changed to UFS2 when UFS2 proves itself to be stable. In this commit the boot code for reading UFS2 filesystems is not compiled (see /sys/boot/common/ufsread.c) as there is insufficient space in the boot block. Once the size of the boot block is increased, this code can be defined. Things to note: the definition of SBSIZE has changed to SBLOCKSIZE. The header file <ufs/ufs/dinode.h> must be included before <ufs/ffs/fs.h> so as to get the definitions of ufs2_daddr_t and ufs_lbn_t. Still TODO: Verify that the first level bootstraps work for all the architectures. Convert the utility ffsinfo to understand UFS2 and test growfs. Add support for the extended attribute storage. Update soft updates to ensure integrity of extended attribute storage. Switch the current extended attribute interfaces to use the extended attribute storage. Add the extent like functionality (framework is there, but is currently never used). Sponsored by: DARPA & NAI Labs. Reviewed by: Poul-Henning Kamp <phk@freebsd.org>
* Change the way we internally store the mount options tomux2002-06-201-59/+17
| | | | | | | | | | a linked list. This is to allow the merging of the mount options in the MNT_UPDATE case, as the current data structure is unsuitable for this. There are no functional differences in this commit. Reviewed by: phk
* Remove a duplicated vfs_freeopts() that I introduced in lastmux2002-05-281-2/+1
| | | | revision.
* Style nit, no functional changes.mux2002-05-231-0/+1
|
* Slightly change the way we pass mount options to the filesystemmux2002-05-231-6/+12
| | | | | | VFS_NMOUNT operations. Reviewed by: phk
* Change two vput() that should have been vrele().mux2002-05-201-2/+2
| | | | Submitted by: iedowse
* More s/file system/filesystem/gtrhodes2002-05-161-5/+5
|
* Disable the shared locking namei() code for now. It breaks several stackingjeff2002-05-141-1/+1
| | | | | filesystems. This is on hold until the rest of VFS Locking is reviewed and deemed safe. It can be enabled with 'options LOOKUP_SHARED'.
* Add the lchflags(2) syscall.mux2002-05-051-0/+23
| | | | Reviewed by: rwatson
* Move a KASSERT() in open() prior to unlocking the vnode. It's not safe tojeff2002-05-051-3/+4
| | | | call VOP_GETVOBJECT without a lock.
* Fix a typo.mux2002-05-041-1/+1
| | | | Submitted by: dwmalone
* Slightly restructure extattr_get_vp() so that there's only one entry pointrwatson2002-04-231-8/+15
| | | | | | | to VOP_GETEXTATTR(). This simplifies code flow when inserting MAC hooks. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Improve style consistency of vfs_syscalls.c by converting the style usedrwatson2002-04-201-53/+82
| | | | | | | | | | | | | in various extattr_*() calls to match the rest of the file. Originally, these bits at the end looked more like style(9). This patch was submitted by green by way of the TrustedBSD MAC tree, and I fixed a few problems with it on the way through. Someone with more time on their hands should convert the entire file to style(9); this commit is for diff reduction purposes. Submitted by: green Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
OpenPOWER on IntegriCloud