summaryrefslogtreecommitdiffstats
path: root/sys/kern/vfs_vnops.c
Commit message (Collapse)AuthorAgeFilesLines
* Bow to the whining masses and change a union back into void *. Retaindillon2003-01-131-7/+7
| | | | | removal of unnecessary casts and throw in some minor cleanups to see if anyone complains, just for the hell of it.
* Change struct file f_data to un_data, a union of the correct structdillon2003-01-121-8/+7
| | | | | | | | | | pointer types, and remove a huge number of casts from code using it. Change struct xfile xf_data to xun_data (ABI is still compatible). If we need to add a #define for f_data and xf_data we can, but I don't think it will be necessary. There are no operational changes in this commit.
* In vn_open(), unset ndp->ni_vp when returning failure so that codegreen2003-01-071-0/+1
| | | | | | | which expects it to be NULL unless the return value was 0 will work. Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Abstract-out the constants for the sequential heuristic.dillon2002-12-281-3/+3
| | | | | | No operational changes. MFC after: 1 day
* White-space changes.phk2002-12-241-7/+7
|
* Detediousficate declaration of fileops array members by introducingphk2002-12-231-12/+7
| | | | typedefs for them.
* Within ufs, the ffs_sync and ffs_fsync functions did not alwaysmckusick2002-10-251-3/+8
| | | | | | | | | | | | check for and/or report I/O errors. The result is that a VFS_SYNC or VOP_FSYNC called with MNT_WAIT could loop infinitely on ufs in the presence of a hard error writing a disk sector or in a filesystem full condition. This patch ensures that I/O errors will always be checked and returned. This patch also ensures that every call to VFS_SYNC or VOP_FSYNC with MNT_WAIT set checks for and takes appropriate action when an error is returned. Sponsored by: DARPA & NAI Labs.
* Drop in the MAC check for file creation as part of open().rwatson2002-10-191-3/+11
| | | | | | Approved by: re Obtained from: TrustedBSD Project Sponsored by: DARPA, Network Associates Laboratories
* Under DIAGNOSTIC, complain if ENOIOCTL leaks out through VOP_IOCTL().phk2002-09-261-0/+6
|
* Replace various spelling with FALLTHROUGH which is lint()ablecharnier2002-08-251-1/+1
|
* - Fix a mistake in my last few commits. The PDROP flag stops msleep fromjeff2002-08-231-2/+1
| | | | | | | re-acquiring the mutex. Pointy hat to: me Noticed by: tegge
* - Closer inspection revealed a possible deadlock situation in vn_lock() thatjeff2002-08-221-16/+13
| | | | | was introduced by my last commit but not caught by stress testing. Fix that and slightly restructure the code so that it is more readable.
* - Make vn_lock() vget() and VOP_LOCK() all behave the same way WRTjeff2002-08-221-3/+2
| | | | | | | | LK_INTERLOCK. The interlock will never be held on return from these functions even when there is an error. Errors typically only occur when the XLOCK is held which means this isn't the vnode we want anyway. Almost all users of these interfaces expected this behavior even though it was not provided before.
* - Return two shared locks to exclusive locks. This was premature.jeff2002-08-221-2/+11
| | | | - Document the problems that prevent us from using shared locks.
* - Fix interlock handling in vn_lock(). Previously, vn_lock() could returnjeff2002-08-221-10/+12
| | | | | | | with interlock held in error conditions when the caller did not specify LK_INTERLOCK. - Add several comments to vn_lock() describing the rational behind the code flow since it was not immediately obvious.
* - Document two cases, one in vget and the other in vn_lock, where the statejeff2002-08-211-0/+1
| | | | | of interlock on exit is not consistent. There are probably several bugs relating to this.
* Pass active_cred and file_cred into the MAC framework explicitlyrwatson2002-08-191-6/+8
| | | | | | | | | | | for mac_check_vnode_{poll,read,stat,write}(). Pass in fp->f_cred when calling these checks with a struct file available. Otherwise, pass NOCRED. All currently MAC policies use active_cred, but could now offer the cached credential semantic used for the base system security model. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Break out mac_check_vnode_op() into three seperate checks:rwatson2002-08-191-7/+5
| | | | | | | | | | mac_check_vnode_poll(), mac_check_vnode_read(), mac_check_vnode_write(). This improves the consistency with other existing vnode checks, and allows policies to avoid implementing switch statements to determine what operations they do and do not want to authorize. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* In continuation of early fileop credential changes, modify fo_ioctl() torwatson2002-08-171-4/+5
| | | | | | | | | | | | | | | | | | | | | | accept an 'active_cred' argument reflecting the credential of the thread initiating the ioctl operation. - Change fo_ioctl() to accept active_cred; change consumers of the fo_ioctl() interface to generally pass active_cred from td->td_ucred. - In fifofs, initialize filetmp.f_cred to ap->a_cred so that the invocations of soo_ioctl() are provided access to the calling f_cred. Pass ap->a_td->td_ucred as the active_cred, but note that this is required because we don't yet distinguish file_cred and active_cred in invoking VOP's. - Update kqueue_ioctl() for its new argument. - Update pipe_ioctl() for its new argument, pass active_cred rather than td_ucred to MAC for authorization. - Update soo_ioctl() for its new argument. - Update vn_ioctl() for its new argument, use active_cred rather than td->td_ucred to authorize VOP_IOCTL() and the associated VOP_GETATTR(). Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Make similar changes to fo_stat() and fo_poll() as made earlier torwatson2002-08-161-14/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | fo_read() and fo_write(): explicitly use the cred argument to fo_poll() as "active_cred" using the passed file descriptor's f_cred reference to provide access to the file credential. Add an active_cred argument to fo_stat() so that implementers have access to the active credential as well as the file credential. Generally modify callers of fo_stat() to pass in td->td_ucred rather than fp->f_cred, which was redundantly provided via the fp argument. This set of modifications also permits threads to perform these operations on behalf of another thread without modifying their credential. Trickle this change down into fo_stat/poll() implementations: - badfo_poll(), badfo_stat(): modify/add arguments. - kqueue_poll(), kqueue_stat(): modify arguments. - pipe_poll(), pipe_stat(): modify/add arguments, pass active_cred to MAC checks rather than td->td_ucred. - soo_poll(), soo_stat(): modify/add arguments, pass fp->f_cred rather than cred to pru_sopoll() to maintain current semantics. - sopoll(): moidfy arguments. - vn_poll(), vn_statfile(): modify/add arguments, pass new arguments to vn_stat(). Pass active_cred to MAC and fp->f_cred to VOP_POLL() to maintian current semantics. - vn_close(): rename cred to file_cred to reflect reality while I'm here. - vn_stat(): Add active_cred and file_cred arguments to vn_stat() and consumers so that this distinction is maintained at the VFS as well as 'struct file' layer. Pass active_cred instead of td->td_ucred to MAC and to VOP_GETATTR() to maintain current semantics. - fifofs: modify the creation of a "filetemp" so that the file credential is properly initialized and can be used in the socket code if desired. Pass ap->a_td->td_ucred as the active credential to soo_poll(). If we teach the vnop interface about the distinction between file and active credentials, we would use the active credential here. Note that current inconsistent passing of active_cred vs. file_cred to VOP's is maintained. It's not clear why GETATTR would be authorized using active_cred while POLL would be authorized using file_cred at the file system level. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* In order to better support flexible and extensible access control,rwatson2002-08-151-19/+28
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | make a series of modifications to the credential arguments relating to file read and write operations to cliarfy which credential is used for what: - Change fo_read() and fo_write() to accept "active_cred" instead of "cred", and change the semantics of consumers of fo_read() and fo_write() to pass the active credential of the thread requesting an operation rather than the cached file cred. The cached file cred is still available in fo_read() and fo_write() consumers via fp->f_cred. These changes largely in sys_generic.c. For each implementation of fo_read() and fo_write(), update cred usage to reflect this change and maintain current semantics: - badfo_readwrite() unchanged - kqueue_read/write() unchanged pipe_read/write() now authorize MAC using active_cred rather than td->td_ucred - soo_read/write() unchanged - vn_read/write() now authorize MAC using active_cred but VOP_READ/WRITE() with fp->f_cred Modify vn_rdwr() to accept two credential arguments instead of a single credential: active_cred and file_cred. Use active_cred for MAC authorization, and select a credential for use in VOP_READ/WRITE() based on whether file_cred is NULL or not. If file_cred is provided, authorize the VOP using that cred, otherwise the active credential, matching current semantics. Modify current vn_rdwr() consumers to pass a file_cred if used in the context of a struct file, and to always pass active_cred. When vn_rdwr() is used without a file_cred, pass NOCRED. These changes should maintain current semantics for read/write, but avoid a redundant passing of fp->f_cred, as well as making it more clear what the origin of each credential is in file descriptor read/write operations. Follow-up commits will make similar changes to other file descriptor operations, and modify the MAC framework to pass both credentials to MAC policy modules so they can implement either semantic for revocation. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Implement IO_NOMACCHECK in vn_rdwr() -- perform MAC checks (assumingrwatson2002-08-121-4/+17
| | | | | | | | | | | 'options MAC') as long as IO_NOMACCHECK is not set in the IO flags. If IO_NOMACCHECK is set, bypass MAC checks in vn_rdwr(). This allows vn_rdwr() to be used as a utility function inside of file systems where MAC checks have already been performed, or where the operation is being done on behalf of the kernel not the user. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI LAbs
* Due to layering problems, remove the MAC checks from vn_rdwr() -- thisrwatson2002-08-081-13/+4
| | | | | | | | | VOP wrapper is called from within file systems so can result in odd loopback effects when MAC enforcement is use with the active (as opposed to saved) credential. These checks will be moved elsewhere. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* - Replace v_flag with v_iflag and v_vflagjeff2002-08-041-5/+7
| | | | | | | | | | | | | | | - v_vflag is protected by the vnode lock and is used when synchronization with VOP calls is needed. - v_iflag is protected by interlock and is used for dealing with vnode management issues. These flags include X/O LOCK, FREE, DOOMED, etc. - All accesses to v_iflag and v_vflag have either been locked or marked with mp_fixme's. - Many ASSERT_VOP_LOCKED calls have been added where the locking was not clear. - Many functions in vfs_subr.c were restructured to provide for stronger locking. Idea stolen from: BSD/OS
* Since we have the struct file data pointer cached in vp, use thatrwatson2002-08-011-1/+1
| | | | instead when invoking VOP_POLL().
* Introduce support for Mandatory Access Control and extensiblerwatson2002-08-011-4/+39
| | | | | | | | | | | | | | | | | kernel access control Invoke appropriate MAC framework entry points to authorize a number of vnode operations, including read, write, stat, poll. This permits MAC policies to revoke access to files following label changes, and to limit information spread about the file to user processes. Note: currently the file cached credential is used for some of these authorization check. We will need to expand some of the MAC entry point APIs to permit multiple creds to be passed to the access control check to allow diverse policy behavior. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce support for Mandatory Access Control and extensiblerwatson2002-08-011-11/+21
| | | | | | | | | | | | | | kernel access control. Restructure the vn_open_cred() access control checks to invoke the MAC entry point for open authorization. Note that MAC can reject open requests where existing DAC code skips the open authorization check due to O_CREAT. However, the failure mode here is the same as other failure modes following creation, wherein an empty file may be left behind. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Introduce struct xvnode, which will be used instead of struct vnode fordes2002-07-311-0/+7
| | | | | | | | sysctl purposes. Also add two fields to struct vnode, v_cachedfs and v_cachedid, which hold the vnode's device and file id and are filled in by vn_open_cred() and vn_stat(). Sponsored by: DARPA, NAI Labs
* Set VAPPEND in open mode when O_APPEND is specified as an argument torwatson2002-07-221-0/+2
| | | | | | | | | | | open() of fhopen(). Currently this has no actual affect due to the treatment of VAPPEND in vaccess() and vaccess_acl() as a subset of VWRITE, but when MAC comes in, MAC will distinguish the two. Note: if any file systems are cutting their own permission models, they may wish to now take this into account. Obtained from: TrustedBSD Project Sponsored by: DARPA, NAI Labs
* Change the name of st_createtime to st_birthtime. This change ismckusick2002-07-161-1/+1
| | | | | | | made to reduce confusion between st_ctime and st_createtime. Submitted by: Eric Allman <eric@sendmail.org> Sponsored by: DARPA & NAI Labs.
* More caddr_t removal, make fo_ioctl take a void * instead of a caddr_t.alfred2002-06-291-2/+2
|
* Clean up vn_rdwr locking.jeff2002-06-281-6/+12
| | | | | - Do shared locks on read. - Only do vn_{start,finished}_write when writing.
* Use proper size in bzero of stat structure.mckusick2002-06-241-1/+1
| | | | | Submitted by: Jake Burkholder <jake@locore.ca> Sponsored by: DARPA & NAI Labs.
* This patch fixes a size problem with the stat structure formckusick2002-06-221-2/+1
| | | | | | | | | 64-bit architectures that was introduced in the UFS2 code merge two days ago. The stat structure change that caused the problem was the addition of the file create time. Submitted by: Bruce Evans <bde@zeta.org.au> Sponsored by: DARPA & NAI Labs.
* This commit adds basic support for the UFS2 filesystem. The UFS2mckusick2002-06-211-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | filesystem expands the inode to 256 bytes to make space for 64-bit block pointers. It also adds a file-creation time field, an ability to use jumbo blocks per inode to allow extent like pointer density, and space for extended attributes (up to twice the filesystem block size worth of attributes, e.g., on a 16K filesystem, there is space for 32K of attributes). UFS2 fully supports and runs existing UFS1 filesystems. New filesystems built using newfs can be built in either UFS1 or UFS2 format using the -O option. In this commit UFS1 is the default format, so if you want to build UFS2 format filesystems, you must specify -O 2. This default will be changed to UFS2 when UFS2 proves itself to be stable. In this commit the boot code for reading UFS2 filesystems is not compiled (see /sys/boot/common/ufsread.c) as there is insufficient space in the boot block. Once the size of the boot block is increased, this code can be defined. Things to note: the definition of SBSIZE has changed to SBLOCKSIZE. The header file <ufs/ufs/dinode.h> must be included before <ufs/ffs/fs.h> so as to get the definitions of ufs2_daddr_t and ufs_lbn_t. Still TODO: Verify that the first level bootstraps work for all the architectures. Convert the utility ffsinfo to understand UFS2 and test growfs. Add support for the extended attribute storage. Update soft updates to ensure integrity of extended attribute storage. Switch the current extended attribute interfaces to use the extended attribute storage. Add the extent like functionality (framework is there, but is currently never used). Sponsored by: DARPA & NAI Labs. Reviewed by: Poul-Henning Kamp <phk@freebsd.org>
* Disable the shared locking namei() code for now. It breaks several stackingjeff2002-05-141-5/+5
| | | | | filesystems. This is on hold until the rest of VFS Locking is reviewed and deemed safe. It can be enabled with 'options LOOKUP_SHARED'.
* Lock proctree_lock instead of pgrpsess_lock.jhb2002-04-161-3/+3
|
* Use VOP_GETVOBJECT instead of accessing the member directly. This fixedjeff2002-04-141-1/+1
| | | | | | an issue with nullfs and NAMEI shared. Submitted by: Alexander Kabaev
* Turn #ifdef LOOKUP_SHARED into #ifndef LOOKUP_EXCLUSIVE to enable thisjeff2002-04-091-5/+5
| | | | | | | | | behavior by default. Also, change the options line to reflect this. If there are no problems reported this will become the only behavior and the knob will be removed in a month or so. Demanded by: obrien
* Change the suser() API to take advantage of td_ucred as well as do ajhb2002-04-011-1/+1
| | | | | | | | | | | | general cleanup of the API. The entire API now consists of two functions similar to the pre-KSE API. The suser() function takes a thread pointer as its only argument. The td_ucred member of this thread must be valid so the only valid thread pointers are curthread and a few kernel threads such as thread0. The suser_cred() function takes a pointer to a struct ucred as its first argument and an integer flag as its second argument. The flag is currently only used for the PRISON_ROOT flag. Discussed on: smp@
* Added used include of <sys/sx.h>. Don't depend on namespace pollution inbde2002-03-261-0/+1
| | | | <sys/file.h>.
* Remove __P.alfred2002-03-191-11/+11
|
* Giant pushdown for read/write/pread/pwrite syscalls.alfred2002-03-151-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | kern/kern_descrip.c: Aquire Giant in fdrop_locked when file refcount hits zero, this removes the requirement for the caller to own Giant for the most part. kern/kern_ktrace.c: Aquire Giant in ktrgenio, simplifies locking in upper read/write syscalls. kern/vfs_bio.c: Aquire Giant in bwillwrite if needed. kern/sys_generic.c Giant pushdown, remove Giant for: read, pread, write and pwrite. readv and writev aren't done yet because of the possible malloc calls for iov to uio processing. kern/sys_socket.c Grab giant in the socket fo_read/write functions. kern/vfs_vnops.c Grab giant in the vnode fo_read/write functions.
* This patch adds the "LOCKSHARED" option to namei which causes it to only ↵jeff2002-03-121-0/+34
| | | | | | | | | | | | | | | | acquire shared locks on leafs. The stat() and open() calls have been changed to make use of this new functionality. Using shared locks in these cases is sufficient and can significantly reduce their latency if IO is pending to these vnodes. Also, this reduces the number of exclusive locks that are floating around in the system, which helps reduce the number of deadlocks that occur. A new kernel option "LOOKUP_SHARED" has been added. It defaults to off so this patch can be turned on for testing, and should eventually go away once it is proven to be stable. I have personally been running this patch for over a year now, so it is believed to be fully stable. Reviewed by: jake, obrien Approved by: jake
* Stop abusing the pgrpsess_lock.tanimura2002-03-111-3/+3
|
* Document all functions, global and static variables, and sysctls.eivind2002-03-051-3/+9
| | | | | | | | Includes some minor whitespace changes, and re-ordering to be able to document properly (e.g, grouping of variables and the SYSCTL macro calls for them, where the documentation has been added.) Reviewed by: phk (but all errors are mine)
* Simple p_ucred -> td_ucred changes to start using the per-thread ucredjhb2002-02-271-6/+6
| | | | reference.
* Lock struct pgrp, session and sigio.tanimura2002-02-231-6/+15
| | | | | | | | | | | | | | | | | | | | | | | | | New locks are: - pgrpsess_lock which locks the whole pgrps and sessions, - pg_mtx which protects the pgrp members, and - s_mtx which protects the session members. Please refer to sys/proc.h for the coverage of these locks. Changes on the pgrp/session interface: - pgfind() needs the pgrpsess_lock held. - The caller of enterpgrp() is responsible to allocate a new pgrp and session. - Call enterthispgrp() in order to enter an existing pgrp. - pgsignal() requires a pgrp lock held. Reviewed by: jhb, alfred Tested on: cvsup.jp.FreeBSD.org (which is a quad-CPU machine running -current)
* More cleanups relating to vm object allocation failure: make sure werwatson2002-02-201-1/+5
| | | | | | | | | call VOP_CLOSE() with vp unlocked; clean up the return path a little, in as much as our namei/vnode operation return paths can be cleared up. For a return case that was apparently never taken, this sure is ugly. Reviewed by: jeffr
* Add the braces missed by revision 1.131.iedowse2002-02-181-1/+2
| | | | Pointy hat to: rwatson
OpenPOWER on IntegriCloud