1 /*
2 * Copyright (c) 2000-2015 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /* Copyright (c) 1995 NeXT Computer, Inc. All Rights Reserved */
29 /*
30 * Copyright (c) 1982, 1986, 1989, 1993
31 * The Regents of the University of California. All rights reserved.
32 * (c) UNIX System Laboratories, Inc.
33 * All or some portions of this file are derived from material licensed
34 * to the University of California by American Telephone and Telegraph
35 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
36 * the permission of UNIX System Laboratories, Inc.
37 *
38 * Redistribution and use in source and binary forms, with or without
39 * modification, are permitted provided that the following conditions
40 * are met:
41 * 1. Redistributions of source code must retain the above copyright
42 * notice, this list of conditions and the following disclaimer.
43 * 2. Redistributions in binary form must reproduce the above copyright
44 * notice, this list of conditions and the following disclaimer in the
45 * documentation and/or other materials provided with the distribution.
46 * 3. All advertising materials mentioning features or use of this software
47 * must display the following acknowledgement:
48 * This product includes software developed by the University of
49 * California, Berkeley and its contributors.
50 * 4. Neither the name of the University nor the names of its contributors
51 * may be used to endorse or promote products derived from this software
52 * without specific prior written permission.
53 *
54 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
55 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
56 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
57 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
58 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
59 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
60 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
61 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
62 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
63 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
64 * SUCH DAMAGE.
65 *
66 * @(#)vfs_lookup.c 8.10 (Berkeley) 5/27/95
67 */
68 /*
69 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
70 * support for mandatory and extensible security protections. This notice
71 * is included in support of clause 2.2 (b) of the Apple Public License,
72 * Version 2.0.
73 */
74
75 #include <sys/param.h>
76 #include <sys/systm.h>
77 #include <sys/syslimits.h>
78 #include <sys/time.h>
79 #include <sys/namei.h>
80 #include <sys/vm.h>
81 #include <sys/vnode_internal.h>
82 #include <sys/mount_internal.h>
83 #include <sys/errno.h>
84 #include <kern/kalloc.h>
85 #include <sys/filedesc.h>
86 #include <sys/proc_internal.h>
87 #include <sys/kdebug.h>
88 #include <sys/unistd.h> /* For _PC_NAME_MAX */
89 #include <sys/uio_internal.h>
90 #include <sys/kauth.h>
91 #include <kern/zalloc.h>
92 #include <security/audit/audit.h>
93 #if CONFIG_MACF
94 #include <security/mac_framework.h>
95 #endif
96 #include <os/atomic_private.h>
97
98 #include <sys/paths.h>
99
100 #if NAMEDRSRCFORK
101 #include <sys/xattr.h>
102 #endif
103 /*
104 * The minimum volfs-style pathname is 9.
105 * Example: "/.vol/1/2"
106 */
107 #define VOLFS_MIN_PATH_LEN 9
108
109
110 #if CONFIG_VOLFS
111 static int vfs_getrealpath(const char * path, char * realpath, size_t bufsize, vfs_context_t ctx);
112 #define MAX_VOLFS_RESTARTS 5
113 #endif
114
115 static int lookup_traverse_mountpoints(struct nameidata *ndp, struct componentname *cnp, vnode_t dp, int vbusyflags, vfs_context_t ctx);
116 static int lookup_handle_symlink(struct nameidata *ndp, vnode_t *new_dp, bool* dp_has_iocount, vfs_context_t ctx);
117 static int lookup_authorize_search(vnode_t dp, struct componentname *cnp, int dp_authorized_in_cache, vfs_context_t ctx);
118 static void lookup_consider_update_cache(vnode_t dvp, vnode_t vp, struct componentname *cnp, int nc_generation);
119 static int lookup_handle_found_vnode(struct nameidata *ndp, struct componentname *cnp, int rdonly,
120 int vbusyflags, int *keep_going, int nc_generation,
121 int wantparent, int atroot, vfs_context_t ctx);
122 static int lookup_handle_emptyname(struct nameidata *ndp, struct componentname *cnp, int wantparent);
123
124 #if NAMEDRSRCFORK
125 static int lookup_handle_rsrc_fork(vnode_t dp, struct nameidata *ndp, struct componentname *cnp, int wantparent, vfs_context_t ctx);
126 #endif
127
128 extern lck_rw_t rootvnode_rw_lock;
129
130 /*
131 * Convert a pathname into a pointer to a locked inode.
132 *
133 * The FOLLOW flag is set when symbolic links are to be followed
134 * when they occur at the end of the name translation process.
135 * Symbolic links are always followed for all other pathname
136 * components other than the last.
137 *
138 * The segflg defines whether the name is to be copied from user
139 * space or kernel space.
140 *
141 * Overall outline of namei:
142 *
143 * copy in name
144 * get starting directory
145 * while (!done && !error) {
146 * call lookup to search path.
147 * if symbolic link, massage name in buffer and continue
148 * }
149 *
150 * Returns: 0 Success
151 * ENOENT No such file or directory
152 * ELOOP Too many levels of symbolic links
153 * ENAMETOOLONG Filename too long
154 * copyinstr:EFAULT Bad address
155 * copyinstr:ENAMETOOLONG Filename too long
156 * lookup:EBADF Bad file descriptor
157 * lookup:EROFS
158 * lookup:EACCES
159 * lookup:EPERM
160 * lookup:ERECYCLE vnode was recycled from underneath us in lookup.
161 * This means we should re-drive lookup from this point.
162 * lookup: ???
163 * VNOP_READLINK:???
164 */
165 int
namei(struct nameidata * ndp)166 namei(struct nameidata *ndp)
167 {
168 struct vnode *dp; /* the directory we are searching */
169 struct vnode *usedvp = ndp->ni_dvp; /* store pointer to vp in case we must loop due to
170 * heavy vnode pressure */
171 uint32_t cnpflags = ndp->ni_cnd.cn_flags; /* store in case we have to restore after loop */
172 int error;
173 struct componentname *cnp = &ndp->ni_cnd;
174 vfs_context_t ctx = cnp->cn_context;
175 proc_t p = vfs_context_proc(ctx);
176 #if CONFIG_AUDIT
177 /* XXX ut should be from context */
178 uthread_t ut = current_uthread();
179 #endif
180
181 #if CONFIG_VOLFS
182 int volfs_restarts = 0;
183 #endif
184 size_t bytes_copied = 0;
185 vnode_t rootdir_with_usecount = NULLVP;
186 vnode_t startdir_with_usecount = NULLVP;
187 vnode_t usedvp_dp = NULLVP;
188 int32_t old_count = 0;
189 bool dp_has_iocount = false;
190
191 #if DIAGNOSTIC
192 if (!vfs_context_ucred(ctx) || !p) {
193 panic("namei: bad cred/proc");
194 }
195 if (cnp->cn_nameiop & (~OPMASK)) {
196 panic("namei: nameiop contaminated with flags");
197 }
198 if (cnp->cn_flags & OPMASK) {
199 panic("namei: flags contaminated with nameiops");
200 }
201 #endif
202
203 /*
204 * A compound VNOP found something that needs further processing:
205 * either a trigger vnode, a covered directory, or a symlink.
206 */
207 if (ndp->ni_flag & NAMEI_CONTLOOKUP) {
208 int rdonly, vbusyflags, keep_going, wantparent;
209
210 rdonly = cnp->cn_flags & RDONLY;
211 vbusyflags = ((cnp->cn_flags & CN_NBMOUNTLOOK) != 0) ? LK_NOWAIT : 0;
212 keep_going = 0;
213 wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT);
214
215 ndp->ni_flag &= ~(NAMEI_CONTLOOKUP);
216
217 error = lookup_handle_found_vnode(ndp, &ndp->ni_cnd, rdonly, vbusyflags,
218 &keep_going, ndp->ni_ncgeneration, wantparent, 0, ctx);
219 if (error) {
220 goto out_drop;
221 }
222 if (keep_going) {
223 if ((cnp->cn_flags & ISSYMLINK) == 0) {
224 panic("We need to keep going on a continued lookup, but for vp type %d (tag %d)", ndp->ni_vp->v_type, ndp->ni_vp->v_tag);
225 }
226 goto continue_symlink;
227 }
228
229 return 0;
230 }
231
232 vnode_recycled:
233
234 /*
235 * Get a buffer for the name to be translated, and copy the
236 * name into the buffer.
237 */
238 if ((cnp->cn_flags & HASBUF) == 0) {
239 cnp->cn_pnbuf = ndp->ni_pathbuf;
240 cnp->cn_pnlen = PATHBUFLEN;
241 }
242 #if LP64_DEBUG
243 if ((UIO_SEG_IS_USER_SPACE(ndp->ni_segflg) == 0)
244 && (ndp->ni_segflg != UIO_SYSSPACE)
245 && (ndp->ni_segflg != UIO_SYSSPACE32)) {
246 panic("invalid ni_segflg");
247 }
248 #endif /* LP64_DEBUG */
249
250 retry_copy:
251 if (UIO_SEG_IS_USER_SPACE(ndp->ni_segflg)) {
252 error = copyinstr(ndp->ni_dirp, cnp->cn_pnbuf,
253 cnp->cn_pnlen, &bytes_copied);
254 } else {
255 error = copystr(CAST_DOWN(void *, ndp->ni_dirp), cnp->cn_pnbuf,
256 cnp->cn_pnlen, &bytes_copied);
257 }
258 if (error == ENAMETOOLONG && !(cnp->cn_flags & HASBUF)) {
259 cnp->cn_pnbuf = zalloc(ZV_NAMEI);
260 cnp->cn_flags |= HASBUF;
261 cnp->cn_pnlen = MAXPATHLEN;
262 bytes_copied = 0;
263
264 goto retry_copy;
265 }
266 if (error) {
267 goto error_out;
268 }
269 assert(bytes_copied <= MAXPATHLEN);
270 ndp->ni_pathlen = (u_int)bytes_copied;
271 bytes_copied = 0;
272
273 /*
274 * Since the name cache may contain positive entries of
275 * the incorrect case, force lookup() to bypass the cache
276 * and call directly into the filesystem for each path
277 * component. Note: the FS may still consult the cache,
278 * but can apply rules to validate the results.
279 */
280 if (proc_is_forcing_hfs_case_sensitivity(p)) {
281 cnp->cn_flags |= CN_SKIPNAMECACHE;
282 }
283
284 #if CONFIG_VOLFS
285 /*
286 * Check for legacy volfs style pathnames.
287 *
288 * For compatibility reasons we currently allow these paths,
289 * but future versions of the OS may not support them.
290 */
291 if (ndp->ni_pathlen >= VOLFS_MIN_PATH_LEN &&
292 cnp->cn_pnbuf[0] == '/' &&
293 cnp->cn_pnbuf[1] == '.' &&
294 cnp->cn_pnbuf[2] == 'v' &&
295 cnp->cn_pnbuf[3] == 'o' &&
296 cnp->cn_pnbuf[4] == 'l' &&
297 cnp->cn_pnbuf[5] == '/') {
298 char * realpath;
299 int realpath_err;
300 /* Attempt to resolve a legacy volfs style pathname. */
301 realpath = zalloc(ZV_NAMEI);
302 /*
303 * We only error out on the ENAMETOOLONG cases where we know that
304 * vfs_getrealpath translation succeeded but the path could not fit into
305 * MAXPATHLEN characters. In other failure cases, we may be dealing with a path
306 * that legitimately looks like /.vol/1234/567 and is not meant to be translated
307 */
308 if ((realpath_err = vfs_getrealpath(&cnp->cn_pnbuf[6], realpath, MAXPATHLEN, ctx))) {
309 zfree(ZV_NAMEI, realpath);
310 if (realpath_err == ENOSPC || realpath_err == ENAMETOOLONG) {
311 error = ENAMETOOLONG;
312 goto error_out;
313 }
314 } else {
315 size_t tmp_len;
316 if (cnp->cn_flags & HASBUF) {
317 zfree(ZV_NAMEI, cnp->cn_pnbuf);
318 }
319 cnp->cn_pnbuf = realpath;
320 cnp->cn_pnlen = MAXPATHLEN;
321 tmp_len = strlen(realpath) + 1;
322 assert(tmp_len <= UINT_MAX);
323 ndp->ni_pathlen = (u_int)tmp_len;
324 cnp->cn_flags |= HASBUF | CN_VOLFSPATH;
325 }
326 }
327 #endif /* CONFIG_VOLFS */
328
329 #if CONFIG_AUDIT
330 /* If we are auditing the kernel pathname, save the user pathname */
331 if (cnp->cn_flags & AUDITVNPATH1) {
332 AUDIT_ARG(upath, ut->uu_cdir, cnp->cn_pnbuf, ARG_UPATH1);
333 }
334 if (cnp->cn_flags & AUDITVNPATH2) {
335 AUDIT_ARG(upath, ut->uu_cdir, cnp->cn_pnbuf, ARG_UPATH2);
336 }
337 #endif /* CONFIG_AUDIT */
338
339 /*
340 * Do not allow empty pathnames
341 */
342 if (*cnp->cn_pnbuf == '\0') {
343 error = ENOENT;
344 goto error_out;
345 }
346 if (ndp->ni_flag & NAMEI_NOFOLLOW_ANY) {
347 ndp->ni_loopcnt = MAXSYMLINKS;
348 } else {
349 ndp->ni_loopcnt = 0;
350 }
351
352 /*
353 * determine the starting point for the translation.
354 */
355 proc_dirs_lock_shared(p);
356 lck_rw_lock_shared(&rootvnode_rw_lock);
357
358 if (fdt_flag_test(&p->p_fd, FD_CHROOT)) {
359 ndp->ni_rootdir = p->p_fd.fd_rdir;
360 } else {
361 ndp->ni_rootdir = rootvnode;
362 }
363
364 if (!ndp->ni_rootdir) {
365 if (fdt_flag_test(&p->p_fd, FD_CHROOT)) {
366 /* This should be a panic */
367 printf("p->p_fd.fd_rdir is not set\n");
368 } else {
369 printf("rootvnode is not set\n");
370 }
371 lck_rw_unlock_shared(&rootvnode_rw_lock);
372 proc_dirs_unlock_shared(p);
373 error = ENOENT;
374 goto error_out;
375 }
376
377 cnp->cn_nameptr = cnp->cn_pnbuf;
378
379 ndp->ni_usedvp = NULLVP;
380
381 if (*(cnp->cn_nameptr) == '/') {
382 while (*(cnp->cn_nameptr) == '/') {
383 cnp->cn_nameptr++;
384 ndp->ni_pathlen--;
385 }
386 dp = ndp->ni_rootdir;
387 } else if (cnp->cn_flags & USEDVP) {
388 dp = ndp->ni_dvp;
389 ndp->ni_usedvp = dp;
390 usedvp_dp = dp;
391 } else {
392 dp = vfs_context_cwd(ctx);
393 }
394
395 if (dp == NULLVP || (dp->v_lflag & VL_DEAD)) {
396 dp = NULLVP;
397 lck_rw_unlock_shared(&rootvnode_rw_lock);
398 proc_dirs_unlock_shared(p);
399 error = ENOENT;
400 goto error_out;
401 }
402
403 /*
404 * We need our own usecount on the root vnode and the starting dir across
405 * the lookup. There's two things that be done here. We can hold the locks
406 * (which protect the existing usecounts on the directories) across the
407 * lookup or take our own usecount. Holding the locks across the lookup can
408 * cause deadlock issues if we re-enter namei on the same thread so the
409 * correct thing to do is to acquire our own usecount.
410 *
411 * Ideally, the usecount should be obtained by vnode_get->vnode_ref->vnode_put.
412 * However when this vnode is the rootvnode, that sequence will produce a
413 * lot of vnode mutex locks and unlocks on a single vnode (the rootvnode)
414 * and will be highly contended and degrade performance. Since we have
415 * an existing usecount protected by the locks we hold, we'll just use
416 * an atomic op to increment the usecount on a vnode which already has one
417 * and can't be released because we have the locks which protect against that
418 * happening.
419 */
420 rootdir_with_usecount = ndp->ni_rootdir;
421 old_count = os_atomic_inc_orig(&rootdir_with_usecount->v_usecount, relaxed);
422 if (old_count < 1) {
423 panic("(1) invalid pre-increment usecount (%d) for rootdir vnode %p",
424 old_count, rootdir_with_usecount);
425 } else if (old_count == INT32_MAX) {
426 panic("(1) usecount overflow for vnode %p", rootdir_with_usecount);
427 }
428
429 if ((dp != rootdir_with_usecount) && (dp != usedvp_dp)) {
430 old_count = os_atomic_inc_orig(&dp->v_usecount, relaxed);
431 if (old_count < 1) {
432 panic("(2) invalid pre-increment usecount (%d) for vnode %p", old_count, dp);
433 } else if (old_count == INT32_MAX) {
434 panic("(2) usecount overflow for vnode %p", dp);
435 }
436 startdir_with_usecount = dp;
437 }
438
439 /* Now that we have our usecount, release the locks */
440 lck_rw_unlock_shared(&rootvnode_rw_lock);
441 proc_dirs_unlock_shared(p);
442
443 ndp->ni_dvp = NULLVP;
444 ndp->ni_vp = NULLVP;
445
446 for (;;) {
447 #if CONFIG_MACF
448 /*
449 * Give MACF policies a chance to reject the lookup
450 * before performing any filesystem operations.
451 * This hook is called before resolving the path and
452 * again each time a symlink is encountered.
453 * NB: policies receive path information as supplied
454 * by the caller and thus cannot be trusted.
455 */
456 error = mac_vnode_check_lookup_preflight(ctx, dp, cnp->cn_nameptr, cnp->cn_namelen);
457 if (error) {
458 goto error_out;
459 }
460 #endif
461 ndp->ni_startdir = dp;
462 dp = NULLVP;
463
464 if ((error = lookup(ndp))) {
465 goto error_out;
466 }
467
468 /*
469 * Check for symbolic link
470 */
471 if ((cnp->cn_flags & ISSYMLINK) == 0) {
472 if (startdir_with_usecount) {
473 vnode_rele(startdir_with_usecount);
474 startdir_with_usecount = NULLVP;
475 }
476 if (rootdir_with_usecount) {
477 lck_rw_lock_shared(&rootvnode_rw_lock);
478 if (rootdir_with_usecount == rootvnode) {
479 old_count = os_atomic_dec_orig(&rootdir_with_usecount->v_usecount, relaxed);
480 if (old_count < 2) {
481 /*
482 * There needs to have been at least 1 usecount left on the rootvnode
483 */
484 panic("(3) Unexpected pre-decrement value (%d) of usecount for rootvnode %p",
485 old_count, rootdir_with_usecount);
486 }
487 rootdir_with_usecount = NULLVP;
488 }
489 lck_rw_unlock_shared(&rootvnode_rw_lock);
490 if (rootdir_with_usecount) {
491 vnode_rele(rootdir_with_usecount);
492 rootdir_with_usecount = NULLVP;
493 }
494 }
495
496 return 0;
497 }
498
499 continue_symlink:
500 /* Gives us a new path to process, and a starting dir */
501 error = lookup_handle_symlink(ndp, &dp, &dp_has_iocount, ctx);
502 if (error != 0) {
503 break;
504 }
505 if (dp_has_iocount) {
506 if ((dp != rootdir_with_usecount) && (dp != startdir_with_usecount) &&
507 (dp != usedvp_dp)) {
508 if (startdir_with_usecount) {
509 vnode_rele(startdir_with_usecount);
510 }
511 vnode_ref_ext(dp, 0, VNODE_REF_FORCE);
512 startdir_with_usecount = dp;
513 }
514 vnode_put(dp);
515 dp_has_iocount = false;
516 }
517 }
518 /*
519 * only come here if we fail to handle a SYMLINK...
520 * if either ni_dvp or ni_vp is non-NULL, then
521 * we need to drop the iocount that was picked
522 * up in the lookup routine
523 */
524 out_drop:
525 if (ndp->ni_dvp) {
526 vnode_put(ndp->ni_dvp);
527 }
528 if (ndp->ni_vp) {
529 vnode_put(ndp->ni_vp);
530 }
531 error_out:
532 if (startdir_with_usecount) {
533 vnode_rele(startdir_with_usecount);
534 startdir_with_usecount = NULLVP;
535 }
536 if (rootdir_with_usecount) {
537 lck_rw_lock_shared(&rootvnode_rw_lock);
538 if (rootdir_with_usecount == rootvnode) {
539 old_count = os_atomic_dec_orig(&rootdir_with_usecount->v_usecount, relaxed);
540 if (old_count < 2) {
541 /*
542 * There needs to have been at least 1 usecount left on the rootvnode
543 */
544 panic("(4) Unexpected pre-decrement value (%d) of usecount for rootvnode %p",
545 old_count, rootdir_with_usecount);
546 }
547 lck_rw_unlock_shared(&rootvnode_rw_lock);
548 } else {
549 lck_rw_unlock_shared(&rootvnode_rw_lock);
550 vnode_rele(rootdir_with_usecount);
551 }
552 rootdir_with_usecount = NULLVP;
553 }
554
555 if ((cnp->cn_flags & HASBUF)) {
556 cnp->cn_flags &= ~HASBUF;
557 zfree(ZV_NAMEI, cnp->cn_pnbuf);
558 }
559 cnp->cn_pnbuf = NULL;
560 ndp->ni_vp = NULLVP;
561 ndp->ni_dvp = NULLVP;
562
563 #if CONFIG_VOLFS
564 /*
565 * Deal with volfs fallout.
566 *
567 * At this point, if we were originally given a volfs path that
568 * looks like /.vol/123/456, then we would have had to convert it into
569 * a full path. Assuming that part worked properly, we will now attempt
570 * to conduct a lookup of the item in the namespace. Under normal
571 * circumstances, if a user looked up /tmp/foo and it was not there, it
572 * would be permissible to return ENOENT.
573 *
574 * However, we may not want to do that here. Specifically, the volfs path
575 * uniquely identifies a certain item in the namespace regardless of where it
576 * lives. If the item has moved in between the time we constructed the
577 * path and now, when we're trying to do a lookup/authorization on the full
578 * path, we may have gotten an ENOENT.
579 *
580 * At this point we can no longer tell if the path no longer exists
581 * or if the item in question no longer exists. It could have been renamed
582 * away, in which case the /.vol identifier is still valid.
583 *
584 * Do this dance a maximum of MAX_VOLFS_RESTARTS times.
585 */
586 if ((error == ENOENT) && (ndp->ni_cnd.cn_flags & CN_VOLFSPATH)) {
587 if (volfs_restarts < MAX_VOLFS_RESTARTS) {
588 volfs_restarts++;
589 goto vnode_recycled;
590 }
591 }
592 #endif
593
594 if (error == ERECYCLE) {
595 /* vnode was recycled underneath us. re-drive lookup to start at
596 * the beginning again, since recycling invalidated last lookup*/
597 ndp->ni_cnd.cn_flags = cnpflags;
598 ndp->ni_dvp = usedvp;
599 goto vnode_recycled;
600 }
601
602
603 return error;
604 }
605
606 int
namei_compound_available(vnode_t dp,struct nameidata * ndp)607 namei_compound_available(vnode_t dp, struct nameidata *ndp)
608 {
609 if ((ndp->ni_flag & NAMEI_COMPOUNDOPEN) != 0) {
610 return vnode_compound_open_available(dp);
611 }
612
613 return 0;
614 }
615
616 static int
lookup_authorize_search(vnode_t dp,struct componentname * cnp,int dp_authorized_in_cache,vfs_context_t ctx)617 lookup_authorize_search(vnode_t dp, struct componentname *cnp, int dp_authorized_in_cache, vfs_context_t ctx)
618 {
619 #if !CONFIG_MACF
620 #pragma unused(cnp)
621 #endif
622
623 int error;
624
625 if (!dp_authorized_in_cache) {
626 error = vnode_authorize(dp, NULL, KAUTH_VNODE_SEARCH, ctx);
627 if (error) {
628 return error;
629 }
630 }
631 #if CONFIG_MACF
632 error = mac_vnode_check_lookup(ctx, dp, cnp);
633 if (error) {
634 return error;
635 }
636 #endif /* CONFIG_MACF */
637
638 return 0;
639 }
640
641 static void
lookup_consider_update_cache(vnode_t dvp,vnode_t vp,struct componentname * cnp,int nc_generation)642 lookup_consider_update_cache(vnode_t dvp, vnode_t vp, struct componentname *cnp, int nc_generation)
643 {
644 int isdot_or_dotdot;
645 isdot_or_dotdot = (cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.') || (cnp->cn_flags & ISDOTDOT);
646
647 if (vp->v_name == NULL || vp->v_parent == NULLVP) {
648 int update_flags = 0;
649
650 if (isdot_or_dotdot == 0) {
651 if (vp->v_name == NULL) {
652 update_flags |= VNODE_UPDATE_NAME;
653 }
654 if (dvp != NULLVP && vp->v_parent == NULLVP) {
655 update_flags |= VNODE_UPDATE_PARENT;
656 }
657
658 if (update_flags) {
659 vnode_update_identity(vp, dvp, cnp->cn_nameptr, cnp->cn_namelen, cnp->cn_hash, update_flags);
660 }
661 }
662 }
663 if ((cnp->cn_flags & MAKEENTRY) && (vp->v_flag & VNCACHEABLE) && LIST_FIRST(&vp->v_nclinks) == NULL) {
664 /*
665 * missing from name cache, but should
666 * be in it... this can happen if volfs
667 * causes the vnode to be created or the
668 * name cache entry got recycled but the
669 * vnode didn't...
670 * check to make sure that ni_dvp is valid
671 * cache_lookup_path may return a NULL
672 * do a quick check to see if the generation of the
673 * directory matches our snapshot... this will get
674 * rechecked behind the name cache lock, but if it
675 * already fails to match, no need to go any further
676 */
677 if (dvp != NULLVP && (nc_generation == dvp->v_nc_generation) && (!isdot_or_dotdot)) {
678 cache_enter_with_gen(dvp, vp, cnp, nc_generation);
679 }
680 }
681 }
682
683 #if NAMEDRSRCFORK
684 /*
685 * Can change ni_dvp and ni_vp. On success, returns with iocounts on stream vnode (always) and
686 * data fork if requested. On failure, returns with iocount data fork (always) and its parent directory
687 * (if one was provided).
688 */
689 static int
lookup_handle_rsrc_fork(vnode_t dp,struct nameidata * ndp,struct componentname * cnp,int wantparent,vfs_context_t ctx)690 lookup_handle_rsrc_fork(vnode_t dp, struct nameidata *ndp, struct componentname *cnp, int wantparent, vfs_context_t ctx)
691 {
692 vnode_t svp = NULLVP;
693 enum nsoperation nsop;
694 int nsflags;
695 int error;
696
697 if (dp->v_type != VREG) {
698 error = ENOENT;
699 goto out;
700 }
701 switch (cnp->cn_nameiop) {
702 case DELETE:
703 if (cnp->cn_flags & CN_ALLOWRSRCFORK) {
704 nsop = NS_DELETE;
705 } else {
706 error = EPERM;
707 goto out;
708 }
709 break;
710 case CREATE:
711 if (cnp->cn_flags & CN_ALLOWRSRCFORK) {
712 nsop = NS_CREATE;
713 } else {
714 error = EPERM;
715 goto out;
716 }
717 break;
718 case LOOKUP:
719 /* Make sure our lookup of "/..namedfork/rsrc" is allowed. */
720 if (cnp->cn_flags & CN_ALLOWRSRCFORK) {
721 nsop = NS_OPEN;
722 } else {
723 error = EPERM;
724 goto out;
725 }
726 break;
727 default:
728 error = EPERM;
729 goto out;
730 }
731
732 nsflags = 0;
733 if (cnp->cn_flags & CN_RAW_ENCRYPTED) {
734 nsflags |= NS_GETRAWENCRYPTED;
735 }
736
737 /* Ask the file system for the resource fork. */
738 error = vnode_getnamedstream(dp, &svp, XATTR_RESOURCEFORK_NAME, nsop, nsflags, ctx);
739
740 /* During a create, it OK for stream vnode to be missing. */
741 if (error == ENOATTR || error == ENOENT) {
742 error = (nsop == NS_CREATE) ? 0 : ENOENT;
743 }
744 if (error) {
745 goto out;
746 }
747 /* The "parent" of the stream is the file. */
748 if (wantparent) {
749 if (ndp->ni_dvp) {
750 vnode_put(ndp->ni_dvp);
751 }
752 ndp->ni_dvp = dp;
753 } else {
754 vnode_put(dp);
755 }
756 ndp->ni_vp = svp; /* on create this may be null */
757
758 /* Restore the truncated pathname buffer (for audits). */
759 if (ndp->ni_pathlen == 1 && ndp->ni_next[0] == '\0') {
760 /*
761 * While we replaced only '/' with '\0' and would ordinarily
762 * need to just switch that back, the buffer in which we did
763 * this may not be what the pathname buffer is now when symlinks
764 * are involved. If we just restore the "/" we will make the
765 * string not terminated anymore, so be safe and restore the
766 * entire suffix.
767 */
768 strncpy(ndp->ni_next, _PATH_RSRCFORKSPEC, sizeof(_PATH_RSRCFORKSPEC));
769 cnp->cn_nameptr = ndp->ni_next + 1;
770 cnp->cn_namelen = sizeof(_PATH_RSRCFORKSPEC) - 1;
771 ndp->ni_next += cnp->cn_namelen;
772 if (ndp->ni_next[0] != '\0') {
773 panic("Incorrect termination of path in %s", __FUNCTION__);
774 }
775 }
776 cnp->cn_flags &= ~MAKEENTRY;
777
778 return 0;
779 out:
780 return error;
781 }
782 #endif /* NAMEDRSRCFORK */
783
784 /*
785 * iocounts in:
786 * --One on ni_vp. One on ni_dvp if there is more path, or we didn't come through the
787 * cache, or we came through the cache and the caller doesn't want the parent.
788 *
789 * iocounts out:
790 * --Leaves us in the correct state for the next step, whatever that might be.
791 * --If we find a symlink, returns with iocounts on both ni_vp and ni_dvp.
792 * --If we are to look up another component, then we have an iocount on ni_vp and
793 * nothing else.
794 * --If we are done, returns an iocount on ni_vp, and possibly on ni_dvp depending on nameidata flags.
795 * --In the event of an error, may return with ni_dvp NULL'ed out (in which case, iocount
796 * was dropped).
797 */
798 static int
lookup_handle_found_vnode(struct nameidata * ndp,struct componentname * cnp,int rdonly,int vbusyflags,int * keep_going,int nc_generation,int wantparent,int atroot,vfs_context_t ctx)799 lookup_handle_found_vnode(struct nameidata *ndp, struct componentname *cnp, int rdonly,
800 int vbusyflags, int *keep_going, int nc_generation,
801 int wantparent, int atroot, vfs_context_t ctx)
802 {
803 vnode_t dp;
804 int error;
805 char *cp;
806
807 dp = ndp->ni_vp;
808 *keep_going = 0;
809
810 if (ndp->ni_vp == NULLVP) {
811 panic("NULL ni_vp in %s", __FUNCTION__);
812 }
813
814 if (atroot) {
815 goto nextname;
816 }
817
818 /*
819 * Take into account any additional components consumed by
820 * the underlying filesystem.
821 */
822 if (cnp->cn_consume > 0) {
823 cnp->cn_nameptr += cnp->cn_consume;
824 ndp->ni_next += cnp->cn_consume;
825 ndp->ni_pathlen -= cnp->cn_consume;
826 cnp->cn_consume = 0;
827 } else {
828 lookup_consider_update_cache(ndp->ni_dvp, dp, cnp, nc_generation);
829 }
830
831 /*
832 * Check to see if the vnode has been mounted on...
833 * if so find the root of the mounted file system.
834 * Updates ndp->ni_vp.
835 */
836 error = lookup_traverse_mountpoints(ndp, cnp, dp, vbusyflags, ctx);
837 dp = ndp->ni_vp;
838 if (error) {
839 goto out;
840 }
841
842 #if CONFIG_MACF
843 if (vfs_flags(vnode_mount(dp)) & MNT_MULTILABEL) {
844 error = vnode_label(vnode_mount(dp), NULL, dp, NULL, 0, ctx);
845 if (error) {
846 goto out;
847 }
848 }
849 #endif
850
851 /*
852 * Check for symbolic link
853 */
854 if ((dp->v_type == VLNK) &&
855 ((cnp->cn_flags & FOLLOW) || (ndp->ni_flag & NAMEI_TRAILINGSLASH) || *ndp->ni_next == '/')) {
856 cnp->cn_flags |= ISSYMLINK;
857 *keep_going = 1;
858 return 0;
859 }
860
861 /*
862 * Check for bogus trailing slashes.
863 */
864 if ((ndp->ni_flag & NAMEI_TRAILINGSLASH)) {
865 if (dp->v_type != VDIR) {
866 error = ENOTDIR;
867 goto out;
868 }
869 ndp->ni_flag &= ~(NAMEI_TRAILINGSLASH);
870 }
871
872 #if NAMEDSTREAMS
873 /*
874 * Deny namei/lookup requests to resolve paths that point to shadow files.
875 * Access to shadow files must be conducted by explicit calls to VNOP_LOOKUP
876 * directly, and not use lookup/namei
877 */
878 if (vnode_isshadow(dp)) {
879 error = ENOENT;
880 goto out;
881 }
882 #endif
883
884 nextname:
885 /*
886 * Not a symbolic link. If more pathname,
887 * continue at next component, else return.
888 *
889 * Definitely have a dvp if there's another slash
890 */
891 if (*ndp->ni_next == '/') {
892 cnp->cn_nameptr = ndp->ni_next + 1;
893 ndp->ni_pathlen--;
894 while (*cnp->cn_nameptr == '/') {
895 cnp->cn_nameptr++;
896 ndp->ni_pathlen--;
897 }
898
899 cp = cnp->cn_nameptr;
900 vnode_put(ndp->ni_dvp);
901 ndp->ni_dvp = NULLVP;
902
903 if (*cp == '\0') {
904 goto emptyname;
905 }
906
907 *keep_going = 1;
908 return 0;
909 }
910
911 /*
912 * Disallow directory write attempts on read-only file systems.
913 */
914 if (rdonly &&
915 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) {
916 error = EROFS;
917 goto out;
918 }
919
920 /* If SAVESTART is set, we should have a dvp */
921 if (cnp->cn_flags & SAVESTART) {
922 /*
923 * note that we already hold a reference
924 * on both dp and ni_dvp, but for some reason
925 * can't get another one... in this case we
926 * need to do vnode_put on dp in 'bad2'
927 */
928 if ((vnode_get(ndp->ni_dvp))) {
929 error = ENOENT;
930 goto out;
931 }
932 ndp->ni_startdir = ndp->ni_dvp;
933 }
934 if (!wantparent && ndp->ni_dvp) {
935 vnode_put(ndp->ni_dvp);
936 ndp->ni_dvp = NULLVP;
937 }
938
939 if (cnp->cn_flags & AUDITVNPATH1) {
940 AUDIT_ARG(vnpath, dp, ARG_VNODE1);
941 } else if (cnp->cn_flags & AUDITVNPATH2) {
942 AUDIT_ARG(vnpath, dp, ARG_VNODE2);
943 }
944
945 #if NAMEDRSRCFORK
946 /*
947 * Caller wants the resource fork.
948 */
949 if ((cnp->cn_flags & CN_WANTSRSRCFORK) && (dp != NULLVP)) {
950 error = lookup_handle_rsrc_fork(dp, ndp, cnp, wantparent, ctx);
951 if (error != 0) {
952 goto out;
953 }
954
955 dp = ndp->ni_vp;
956 }
957 #endif
958 if (kdebug_enable) {
959 kdebug_lookup(ndp->ni_vp, cnp);
960 }
961
962 return 0;
963
964 emptyname:
965 error = lookup_handle_emptyname(ndp, cnp, wantparent);
966 if (error != 0) {
967 goto out;
968 }
969
970 return 0;
971 out:
972 return error;
973 }
974
975 /*
976 * Comes in iocount on ni_vp. May overwrite ni_dvp, but doesn't interpret incoming value.
977 */
978 static int
lookup_handle_emptyname(struct nameidata * ndp,struct componentname * cnp,int wantparent)979 lookup_handle_emptyname(struct nameidata *ndp, struct componentname *cnp, int wantparent)
980 {
981 vnode_t dp;
982 int error = 0;
983
984 dp = ndp->ni_vp;
985 cnp->cn_namelen = 0;
986 /*
987 * A degenerate name (e.g. / or "") which is a way of
988 * talking about a directory, e.g. like "/." or ".".
989 */
990 if (dp->v_type != VDIR) {
991 error = ENOTDIR;
992 goto out;
993 }
994 if (cnp->cn_nameiop == CREATE && dp == rootvnode) {
995 error = EEXIST;
996 goto out;
997 }
998 if (cnp->cn_nameiop != LOOKUP) {
999 error = EISDIR;
1000 goto out;
1001 }
1002 if (wantparent) {
1003 /*
1004 * note that we already hold a reference
1005 * on dp, but for some reason can't
1006 * get another one... in this case we
1007 * need to do vnode_put on dp in 'bad'
1008 */
1009 if ((vnode_get(dp))) {
1010 error = ENOENT;
1011 goto out;
1012 }
1013 ndp->ni_dvp = dp;
1014 }
1015 cnp->cn_flags &= ~ISDOTDOT;
1016 cnp->cn_flags |= ISLASTCN;
1017 ndp->ni_next = cnp->cn_nameptr;
1018 ndp->ni_vp = dp;
1019
1020 if (cnp->cn_flags & AUDITVNPATH1) {
1021 AUDIT_ARG(vnpath, dp, ARG_VNODE1);
1022 } else if (cnp->cn_flags & AUDITVNPATH2) {
1023 AUDIT_ARG(vnpath, dp, ARG_VNODE2);
1024 }
1025 if (cnp->cn_flags & SAVESTART) {
1026 panic("lookup: SAVESTART");
1027 }
1028
1029 return 0;
1030 out:
1031 return error;
1032 }
1033 /*
1034 * Search a pathname.
1035 * This is a very central and rather complicated routine.
1036 *
1037 * The pathname is pointed to by ni_ptr and is of length ni_pathlen.
1038 * The starting directory is taken from ni_startdir. The pathname is
1039 * descended until done, or a symbolic link is encountered. The variable
1040 * ni_more is clear if the path is completed; it is set to one if a
1041 * symbolic link needing interpretation is encountered.
1042 *
1043 * The flag argument is LOOKUP, CREATE, RENAME, or DELETE depending on
1044 * whether the name is to be looked up, created, renamed, or deleted.
1045 * When CREATE, RENAME, or DELETE is specified, information usable in
1046 * creating, renaming, or deleting a directory entry may be calculated.
1047 * If flag has LOCKPARENT or'ed into it, the parent directory is returned
1048 * locked. If flag has WANTPARENT or'ed into it, the parent directory is
1049 * returned unlocked. Otherwise the parent directory is not returned. If
1050 * the target of the pathname exists and LOCKLEAF is or'ed into the flag
1051 * the target is returned locked, otherwise it is returned unlocked.
1052 * When creating or renaming and LOCKPARENT is specified, the target may not
1053 * be ".". When deleting and LOCKPARENT is specified, the target may be ".".
1054 *
1055 * Overall outline of lookup:
1056 *
1057 * dirloop:
1058 * identify next component of name at ndp->ni_ptr
1059 * handle degenerate case where name is null string
1060 * if .. and crossing mount points and on mounted filesys, find parent
1061 * call VNOP_LOOKUP routine for next component name
1062 * directory vnode returned in ni_dvp, unlocked unless LOCKPARENT set
1063 * component vnode returned in ni_vp (if it exists), locked.
1064 * if result vnode is mounted on and crossing mount points,
1065 * find mounted on vnode
1066 * if more components of name, do next level at dirloop
1067 * return the answer in ni_vp, locked if LOCKLEAF set
1068 * if LOCKPARENT set, return locked parent in ni_dvp
1069 * if WANTPARENT set, return unlocked parent in ni_dvp
1070 *
1071 * Returns: 0 Success
1072 * ENOENT No such file or directory
1073 * EBADF Bad file descriptor
1074 * ENOTDIR Not a directory
1075 * EROFS Read-only file system [CREATE]
1076 * EISDIR Is a directory [CREATE]
1077 * cache_lookup_path:ERECYCLE (vnode was recycled from underneath us, redrive lookup again)
1078 * vnode_authorize:EROFS
1079 * vnode_authorize:EACCES
1080 * vnode_authorize:EPERM
1081 * vnode_authorize:???
1082 * VNOP_LOOKUP:ENOENT No such file or directory
1083 * VNOP_LOOKUP:EJUSTRETURN Restart system call (INTERNAL)
1084 * VNOP_LOOKUP:???
1085 * VFS_ROOT:ENOTSUP
1086 * VFS_ROOT:ENOENT
1087 * VFS_ROOT:???
1088 */
1089 int
lookup(struct nameidata * ndp)1090 lookup(struct nameidata *ndp)
1091 {
1092 char *cp; /* pointer into pathname argument */
1093 vnode_t tdp; /* saved dp */
1094 vnode_t dp; /* the directory we are searching */
1095 int docache = 1; /* == 0 do not cache last component */
1096 int wantparent; /* 1 => wantparent or lockparent flag */
1097 int rdonly; /* lookup read-only flag bit */
1098 int dp_authorized = 0;
1099 int error = 0;
1100 struct componentname *cnp = &ndp->ni_cnd;
1101 vfs_context_t ctx = cnp->cn_context;
1102 int vbusyflags = 0;
1103 int nc_generation = 0;
1104 vnode_t last_dp = NULLVP;
1105 int keep_going;
1106 int atroot;
1107
1108 /*
1109 * Setup: break out flag bits into variables.
1110 */
1111 if (cnp->cn_flags & NOCACHE) {
1112 docache = 0;
1113 }
1114 wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT);
1115 rdonly = cnp->cn_flags & RDONLY;
1116 cnp->cn_flags &= ~ISSYMLINK;
1117 cnp->cn_consume = 0;
1118
1119 dp = ndp->ni_startdir;
1120 ndp->ni_startdir = NULLVP;
1121
1122 if ((cnp->cn_flags & CN_NBMOUNTLOOK) != 0) {
1123 vbusyflags = LK_NOWAIT;
1124 }
1125 cp = cnp->cn_nameptr;
1126
1127 if (*cp == '\0') {
1128 if ((vnode_getwithref(dp))) {
1129 dp = NULLVP;
1130 error = ENOENT;
1131 goto bad;
1132 }
1133 ndp->ni_vp = dp;
1134 error = lookup_handle_emptyname(ndp, cnp, wantparent);
1135 if (error) {
1136 goto bad;
1137 }
1138
1139 return 0;
1140 }
1141 dirloop:
1142 atroot = 0;
1143 ndp->ni_vp = NULLVP;
1144
1145 if ((error = cache_lookup_path(ndp, cnp, dp, ctx, &dp_authorized, last_dp))) {
1146 dp = NULLVP;
1147 goto bad;
1148 }
1149 if ((cnp->cn_flags & ISLASTCN)) {
1150 if (docache) {
1151 cnp->cn_flags |= MAKEENTRY;
1152 }
1153 } else {
1154 cnp->cn_flags |= MAKEENTRY;
1155 }
1156
1157 dp = ndp->ni_dvp;
1158
1159 if (ndp->ni_vp != NULLVP) {
1160 /*
1161 * cache_lookup_path returned a non-NULL ni_vp then,
1162 * we're guaranteed that the dp is a VDIR, it's
1163 * been authorized, and vp is not ".."
1164 *
1165 * make sure we don't try to enter the name back into
1166 * the cache if this vp is purged before we get to that
1167 * check since we won't have serialized behind whatever
1168 * activity is occurring in the FS that caused the purge
1169 */
1170 if (dp != NULLVP) {
1171 nc_generation = dp->v_nc_generation - 1;
1172 }
1173
1174 goto returned_from_lookup_path;
1175 }
1176
1177 /*
1178 * Handle "..": two special cases.
1179 * 1. If at root directory (e.g. after chroot)
1180 * or at absolute root directory
1181 * then ignore it so can't get out.
1182 * 2. If this vnode is the root of a mounted
1183 * filesystem, then replace it with the
1184 * vnode which was mounted on so we take the
1185 * .. in the other file system.
1186 */
1187 if ((cnp->cn_flags & ISDOTDOT)) {
1188 /*
1189 * if this is a chroot'ed process, check if the current
1190 * directory is still a subdirectory of the process's
1191 * root directory.
1192 */
1193 if (ndp->ni_rootdir && (ndp->ni_rootdir != rootvnode) &&
1194 dp != ndp->ni_rootdir) {
1195 int sdir_error;
1196 int is_subdir = FALSE;
1197
1198 sdir_error = vnode_issubdir(dp, ndp->ni_rootdir,
1199 &is_subdir, vfs_context_kernel());
1200
1201 /*
1202 * If we couldn't determine if dp is a subdirectory of
1203 * ndp->ni_rootdir (sdir_error != 0), we let the request
1204 * proceed.
1205 */
1206 if (!sdir_error && !is_subdir) {
1207 vnode_put(dp);
1208 dp = ndp->ni_rootdir;
1209 /*
1210 * There's a ref on the process's root directory
1211 * but we can't use vnode_getwithref here as
1212 * there is nothing preventing that ref being
1213 * released by another thread.
1214 */
1215 if (vnode_get(dp)) {
1216 error = ENOENT;
1217 goto bad;
1218 }
1219 }
1220 }
1221
1222 for (;;) {
1223 if (dp == ndp->ni_rootdir || dp == rootvnode) {
1224 ndp->ni_dvp = dp;
1225 ndp->ni_vp = dp;
1226 /*
1227 * we're pinned at the root
1228 * we've already got one reference on 'dp'
1229 * courtesy of cache_lookup_path... take
1230 * another one for the ".."
1231 * if we fail to get the new reference, we'll
1232 * drop our original down in 'bad'
1233 */
1234 if ((vnode_get(dp))) {
1235 error = ENOENT;
1236 goto bad;
1237 }
1238 atroot = 1;
1239 goto returned_from_lookup_path;
1240 }
1241 if ((dp->v_flag & VROOT) == 0 ||
1242 (cnp->cn_flags & NOCROSSMOUNT)) {
1243 break;
1244 }
1245 if (dp->v_mount == NULL) { /* forced umount */
1246 error = EBADF;
1247 goto bad;
1248 }
1249 tdp = dp;
1250 dp = tdp->v_mount->mnt_vnodecovered;
1251
1252 if ((vnode_getwithref(dp))) {
1253 vnode_put(tdp);
1254 dp = NULLVP;
1255 error = ENOENT;
1256 goto bad;
1257 }
1258
1259 vnode_put(tdp);
1260
1261 ndp->ni_dvp = dp;
1262 dp_authorized = 0;
1263 }
1264 }
1265
1266 /*
1267 * We now have a segment name to search for, and a directory to search.
1268 */
1269 #if CONFIG_UNION_MOUNTS
1270 unionlookup:
1271 #endif /* CONFIG_UNION_MOUNTS */
1272 ndp->ni_vp = NULLVP;
1273
1274 if (dp->v_type != VDIR) {
1275 error = ENOTDIR;
1276 goto lookup_error;
1277 }
1278 if ((cnp->cn_flags & DONOTAUTH) != DONOTAUTH) {
1279 error = lookup_authorize_search(dp, cnp, dp_authorized, ctx);
1280 if (error) {
1281 goto lookup_error;
1282 }
1283 }
1284
1285 /*
1286 * Now that we've authorized a lookup, can bail out if the filesystem
1287 * will be doing a batched operation. Return an iocount on dvp.
1288 */
1289 #if NAMEDRSRCFORK
1290 if ((cnp->cn_flags & ISLASTCN) && namei_compound_available(dp, ndp) && !(cnp->cn_flags & CN_WANTSRSRCFORK)) {
1291 #else
1292 if ((cnp->cn_flags & ISLASTCN) && namei_compound_available(dp, ndp)) {
1293 #endif /* NAMEDRSRCFORK */
1294 ndp->ni_flag |= NAMEI_UNFINISHED;
1295 ndp->ni_ncgeneration = dp->v_nc_generation;
1296 return 0;
1297 }
1298
1299 nc_generation = dp->v_nc_generation;
1300
1301 /*
1302 * Note:
1303 * Filesystems that support hardlinks may want to call vnode_update_identity
1304 * if the lookup operation below will modify the in-core vnode to belong to a new point
1305 * in the namespace. VFS cannot infer whether or not the look up operation makes the vnode
1306 * name change or change parents. Without this, the lookup may make update
1307 * filesystem-specific in-core metadata but fail to update the v_parent or v_name
1308 * fields in the vnode. If VFS were to do this, it would be necessary to call
1309 * vnode_update_identity on every lookup operation -- expensive!
1310 *
1311 * However, even with this in place, multiple lookups may occur in between this lookup
1312 * and the subsequent vnop, so, at best, we could only guarantee that you would get a
1313 * valid path back, and not necessarily the one that you wanted.
1314 *
1315 * Example:
1316 * /tmp/a == /foo/b
1317 *
1318 * If you are now looking up /foo/b and the vnode for this link represents /tmp/a,
1319 * vnode_update_identity will fix the parentage so that you can get /foo/b back
1320 * through the v_parent chain (preventing you from getting /tmp/b back). It would
1321 * not fix whether or not you should or should not get /tmp/a vs. /foo/b.
1322 */
1323
1324 error = VNOP_LOOKUP(dp, &ndp->ni_vp, cnp, ctx);
1325
1326 if (error) {
1327 lookup_error:
1328 #if CONFIG_UNION_MOUNTS
1329 if ((error == ENOENT) &&
1330 (dp->v_mount != NULL) &&
1331 (dp->v_mount->mnt_flag & MNT_UNION)) {
1332 tdp = dp;
1333 error = lookup_traverse_union(tdp, &dp, ctx);
1334 vnode_put(tdp);
1335 if (error) {
1336 dp = NULLVP;
1337 goto bad;
1338 }
1339
1340 ndp->ni_dvp = dp;
1341 dp_authorized = 0;
1342 goto unionlookup;
1343 }
1344 #endif /* CONFIG_UNION_MOUNTS */
1345
1346 if (error != EJUSTRETURN) {
1347 goto bad;
1348 }
1349
1350 if (ndp->ni_vp != NULLVP) {
1351 panic("leaf should be empty");
1352 }
1353
1354 #if NAMEDRSRCFORK
1355 /*
1356 * At this point, error should be EJUSTRETURN.
1357 *
1358 * If CN_WANTSRSRCFORK is set, that implies that the
1359 * underlying filesystem could not find the "parent" of the
1360 * resource fork (the data fork), and we are doing a lookup
1361 * for a CREATE event.
1362 *
1363 * However, this should be converted to an error, as the
1364 * failure to find this parent should disallow further
1365 * progress to try and acquire a resource fork vnode.
1366 */
1367 if (cnp->cn_flags & CN_WANTSRSRCFORK) {
1368 error = ENOENT;
1369 goto bad;
1370 }
1371 #endif
1372
1373 error = lookup_validate_creation_path(ndp);
1374 if (error) {
1375 goto bad;
1376 }
1377 /*
1378 * We return with ni_vp NULL to indicate that the entry
1379 * doesn't currently exist, leaving a pointer to the
1380 * referenced directory vnode in ndp->ni_dvp.
1381 */
1382 if (cnp->cn_flags & SAVESTART) {
1383 if ((vnode_get(ndp->ni_dvp))) {
1384 error = ENOENT;
1385 goto bad;
1386 }
1387 ndp->ni_startdir = ndp->ni_dvp;
1388 }
1389 if (!wantparent) {
1390 vnode_put(ndp->ni_dvp);
1391 }
1392
1393 if (kdebug_enable) {
1394 kdebug_lookup(ndp->ni_dvp, cnp);
1395 }
1396 return 0;
1397 }
1398 returned_from_lookup_path:
1399 /* We'll always have an iocount on ni_vp when this finishes. */
1400 error = lookup_handle_found_vnode(ndp, cnp, rdonly, vbusyflags, &keep_going, nc_generation, wantparent, atroot, ctx);
1401 if (error != 0) {
1402 goto bad2;
1403 }
1404
1405 if (keep_going) {
1406 dp = ndp->ni_vp;
1407
1408 /* namei() will handle symlinks */
1409 if ((dp->v_type == VLNK) &&
1410 ((cnp->cn_flags & FOLLOW) || (ndp->ni_flag & NAMEI_TRAILINGSLASH) || *ndp->ni_next == '/')) {
1411 return 0;
1412 }
1413
1414 /*
1415 * Otherwise, there's more path to process.
1416 * cache_lookup_path is now responsible for dropping io ref on dp
1417 * when it is called again in the dirloop. This ensures we hold
1418 * a ref on dp until we complete the next round of lookup.
1419 */
1420 last_dp = dp;
1421
1422 goto dirloop;
1423 }
1424
1425 return 0;
1426 bad2:
1427 if (ndp->ni_dvp) {
1428 vnode_put(ndp->ni_dvp);
1429 }
1430
1431 vnode_put(ndp->ni_vp);
1432 ndp->ni_vp = NULLVP;
1433
1434 if (kdebug_enable) {
1435 kdebug_lookup(dp, cnp);
1436 }
1437 return error;
1438
1439 bad:
1440 if (dp) {
1441 vnode_put(dp);
1442 }
1443 ndp->ni_vp = NULLVP;
1444
1445 if (kdebug_enable) {
1446 kdebug_lookup(dp, cnp);
1447 }
1448 return error;
1449 }
1450
1451 #if CONFIG_UNION_MOUNTS
1452 /*
1453 * Given a vnode in a union mount, traverse to the equivalent
1454 * vnode in the underlying mount.
1455 */
1456 int
1457 lookup_traverse_union(vnode_t dvp, vnode_t *new_dvp, vfs_context_t ctx)
1458 {
1459 char *path = NULL, *pp;
1460 const char *name, *np;
1461 size_t len;
1462 int error = 0;
1463 struct nameidata nd;
1464 vnode_t vp = dvp;
1465
1466 *new_dvp = NULL;
1467
1468 if (vp && vp->v_flag & VROOT) {
1469 *new_dvp = vp->v_mount->mnt_vnodecovered;
1470 if (vnode_getwithref(*new_dvp)) {
1471 return ENOENT;
1472 }
1473 return 0;
1474 }
1475
1476 path = zalloc_flags(ZV_NAMEI, Z_WAITOK | Z_NOFAIL);
1477
1478 /*
1479 * Walk back up to the mountpoint following the
1480 * v_parent chain and build a slash-separated path.
1481 * Then lookup that path starting with the covered vnode.
1482 */
1483 pp = path + (MAXPATHLEN - 1);
1484 *pp = '\0';
1485
1486 while (1) {
1487 name = vnode_getname(vp);
1488 if (name == NULL) {
1489 printf("lookup_traverse_union: null parent name: .%s\n", pp);
1490 error = ENOENT;
1491 goto done;
1492 }
1493 len = strlen(name);
1494 if ((len + 1) > (size_t)(pp - path)) { // Enough space for this name ?
1495 error = ENAMETOOLONG;
1496 vnode_putname(name);
1497 goto done;
1498 }
1499 for (np = name + len; len > 0; len--) { // Copy name backwards
1500 *--pp = *--np;
1501 }
1502 vnode_putname(name);
1503 vp = vp->v_parent;
1504 if (vp == NULLVP || vp->v_flag & VROOT) {
1505 break;
1506 }
1507 *--pp = '/';
1508 }
1509
1510 /* Evaluate the path in the underlying mount */
1511 NDINIT(&nd, LOOKUP, OP_LOOKUP, USEDVP, UIO_SYSSPACE, CAST_USER_ADDR_T(pp), ctx);
1512 nd.ni_dvp = dvp->v_mount->mnt_vnodecovered;
1513 error = namei(&nd);
1514 if (error == 0) {
1515 *new_dvp = nd.ni_vp;
1516 }
1517 nameidone(&nd);
1518 done:
1519 if (path) {
1520 zfree(ZV_NAMEI, path);
1521 }
1522 return error;
1523 }
1524 #endif /* CONFIG_UNION_MOUNTS */
1525
1526 int
1527 lookup_validate_creation_path(struct nameidata *ndp)
1528 {
1529 struct componentname *cnp = &ndp->ni_cnd;
1530
1531 /*
1532 * If creating and at end of pathname, then can consider
1533 * allowing file to be created.
1534 */
1535 if (cnp->cn_flags & RDONLY) {
1536 return EROFS;
1537 }
1538 if ((cnp->cn_flags & ISLASTCN) && (ndp->ni_flag & NAMEI_TRAILINGSLASH) && !(cnp->cn_flags & WILLBEDIR)) {
1539 return ENOENT;
1540 }
1541
1542 return 0;
1543 }
1544
1545 /*
1546 * Modifies only ni_vp. Always returns with ni_vp still valid (iocount held).
1547 */
1548 static int
1549 lookup_traverse_mountpoints(struct nameidata *ndp, struct componentname *cnp, vnode_t dp,
1550 int vbusyflags, vfs_context_t ctx)
1551 {
1552 mount_t mp;
1553 vnode_t tdp;
1554 int error = 0;
1555 uint32_t depth = 0;
1556 vnode_t mounted_on_dp;
1557 int current_mount_generation = 0;
1558 #if CONFIG_TRIGGERS
1559 vnode_t triggered_dp = NULLVP;
1560 int retry_cnt = 0;
1561 #define MAX_TRIGGER_RETRIES 1
1562 #endif
1563
1564 if (dp->v_type != VDIR || cnp->cn_flags & NOCROSSMOUNT) {
1565 return 0;
1566 }
1567
1568 mounted_on_dp = dp;
1569 #if CONFIG_TRIGGERS
1570 restart:
1571 #endif
1572 current_mount_generation = mount_generation;
1573
1574 while (dp->v_mountedhere) {
1575 vnode_lock_spin(dp);
1576 if ((mp = dp->v_mountedhere)) {
1577 mp->mnt_crossref++;
1578 vnode_unlock(dp);
1579 } else {
1580 vnode_unlock(dp);
1581 break;
1582 }
1583
1584 if (ISSET(mp->mnt_lflag, MNT_LFORCE)) {
1585 mount_dropcrossref(mp, dp, 0);
1586 break; // don't traverse into a forced unmount
1587 }
1588
1589
1590 if (vfs_busy(mp, vbusyflags)) {
1591 mount_dropcrossref(mp, dp, 0);
1592 if (vbusyflags == LK_NOWAIT) {
1593 error = ENOENT;
1594 goto out;
1595 }
1596
1597 continue;
1598 }
1599
1600 error = VFS_ROOT(mp, &tdp, ctx);
1601
1602 mount_dropcrossref(mp, dp, 0);
1603 vfs_unbusy(mp);
1604
1605 if (error) {
1606 goto out;
1607 }
1608
1609 vnode_put(dp);
1610 ndp->ni_vp = dp = tdp;
1611 if (dp->v_type != VDIR) {
1612 #if DEVELOPMENT || DEBUG
1613 panic("%s : Root of filesystem not a directory",
1614 __FUNCTION__);
1615 #else
1616 break;
1617 #endif
1618 }
1619 depth++;
1620 }
1621
1622 #if CONFIG_TRIGGERS
1623 /*
1624 * The triggered_dp check here is required but is susceptible to a
1625 * (unlikely) race in which trigger mount is done from here and is
1626 * unmounted before we get past vfs_busy above. We retry to deal with
1627 * that case but it has the side effect of unwanted retries for
1628 * "special" processes which don't want to trigger mounts.
1629 */
1630 if (dp->v_resolve && retry_cnt < MAX_TRIGGER_RETRIES) {
1631 error = vnode_trigger_resolve(dp, ndp, ctx);
1632 if (error) {
1633 goto out;
1634 }
1635 if (dp == triggered_dp) {
1636 retry_cnt += 1;
1637 } else {
1638 retry_cnt = 0;
1639 }
1640 triggered_dp = dp;
1641 goto restart;
1642 }
1643 #endif /* CONFIG_TRIGGERS */
1644
1645 if (depth) {
1646 mp = mounted_on_dp->v_mountedhere;
1647
1648 if (mp) {
1649 mount_lock_spin(mp);
1650 mp->mnt_realrootvp_vid = dp->v_id;
1651 mp->mnt_realrootvp = dp;
1652 mp->mnt_generation = current_mount_generation;
1653 mount_unlock(mp);
1654 }
1655 }
1656
1657 return 0;
1658
1659 out:
1660 return error;
1661 }
1662
1663 /*
1664 * Takes ni_vp and ni_dvp non-NULL. Returns with *new_dp set to the location
1665 * at which to start a lookup with a resolved path, and all other iocounts dropped.
1666 */
1667 static int
1668 lookup_handle_symlink(struct nameidata *ndp, vnode_t *new_dp, bool *new_dp_has_iocount, vfs_context_t ctx)
1669 {
1670 int error;
1671 char *cp; /* pointer into pathname argument */
1672 uio_t auio;
1673 uio_stackbuf_t uio_buf[UIO_SIZEOF(1)];
1674 int need_newpathbuf;
1675 u_int linklen = 0;
1676 struct componentname *cnp = &ndp->ni_cnd;
1677 vnode_t dp;
1678 char *tmppn;
1679 u_int rsrclen = (cnp->cn_flags & CN_WANTSRSRCFORK) ? sizeof(_PATH_RSRCFORKSPEC) : 0;
1680 bool dp_has_iocount = false;
1681
1682 if (ndp->ni_loopcnt++ >= MAXSYMLINKS) {
1683 return ELOOP;
1684 }
1685 #if CONFIG_MACF
1686 if ((error = mac_vnode_check_readlink(ctx, ndp->ni_vp)) != 0) {
1687 return error;
1688 }
1689 #endif /* MAC */
1690 if (ndp->ni_pathlen > 1 || !(cnp->cn_flags & HASBUF)) {
1691 need_newpathbuf = 1;
1692 } else {
1693 need_newpathbuf = 0;
1694 }
1695
1696 if (need_newpathbuf) {
1697 cp = zalloc(ZV_NAMEI);
1698 } else {
1699 cp = cnp->cn_pnbuf;
1700 }
1701 auio = uio_createwithbuffer(1, 0, UIO_SYSSPACE, UIO_READ, &uio_buf[0], sizeof(uio_buf));
1702
1703 uio_addiov(auio, CAST_USER_ADDR_T(cp), MAXPATHLEN);
1704
1705 error = VNOP_READLINK(ndp->ni_vp, auio, ctx);
1706
1707 if (!error) {
1708 user_ssize_t resid = uio_resid(auio);
1709
1710 assert(resid <= MAXPATHLEN);
1711
1712 if (resid == MAXPATHLEN) {
1713 linklen = 0;
1714 } else {
1715 /*
1716 * Safe to set unsigned with a [larger] signed type here
1717 * because 0 <= uio_resid <= MAXPATHLEN and MAXPATHLEN
1718 * is only 1024.
1719 */
1720 linklen = (u_int)strnlen(cp, MAXPATHLEN - (u_int)resid);
1721 }
1722
1723 if (linklen == 0) {
1724 error = ENOENT;
1725 } else if (linklen + ndp->ni_pathlen + rsrclen > MAXPATHLEN) {
1726 error = ENAMETOOLONG;
1727 }
1728 }
1729
1730 if (error) {
1731 if (need_newpathbuf) {
1732 zfree(ZV_NAMEI, cp);
1733 }
1734 return error;
1735 }
1736
1737 if (need_newpathbuf) {
1738 tmppn = cnp->cn_pnbuf;
1739 bcopy(ndp->ni_next, cp + linklen, ndp->ni_pathlen);
1740 cnp->cn_pnbuf = cp;
1741 cnp->cn_pnlen = MAXPATHLEN;
1742
1743 if ((cnp->cn_flags & HASBUF)) {
1744 zfree(ZV_NAMEI, tmppn);
1745 } else {
1746 cnp->cn_flags |= HASBUF;
1747 }
1748 } else {
1749 cnp->cn_pnbuf[linklen] = '\0';
1750 }
1751
1752 ndp->ni_pathlen += linklen;
1753 cnp->cn_nameptr = cnp->cn_pnbuf;
1754
1755 /*
1756 * starting point for 'relative'
1757 * symbolic link path
1758 */
1759 dp = ndp->ni_dvp;
1760
1761 /*
1762 * get rid of reference returned via 'lookup'
1763 * ni_dvp is released only if we restart at /.
1764 */
1765 vnode_put(ndp->ni_vp);
1766 ndp->ni_vp = NULLVP;
1767 ndp->ni_dvp = NULLVP;
1768
1769 dp_has_iocount = true;
1770
1771 /*
1772 * Check if symbolic link restarts us at the root
1773 */
1774 if (*(cnp->cn_nameptr) == '/') {
1775 while (*(cnp->cn_nameptr) == '/') {
1776 cnp->cn_nameptr++;
1777 ndp->ni_pathlen--;
1778 }
1779 if (linklen != 0) {
1780 vnode_put(dp); /* ALWAYS have a dvp for a symlink */
1781 dp_has_iocount = false;
1782 if ((dp = ndp->ni_rootdir) == NULLVP) {
1783 return ENOENT;
1784 }
1785 }
1786 }
1787
1788 *new_dp = dp;
1789 *new_dp_has_iocount = dp_has_iocount;
1790
1791 return 0;
1792 }
1793
1794 /*
1795 * relookup - lookup a path name component
1796 * Used by lookup to re-aquire things.
1797 */
1798 int
1799 relookup(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp)
1800 {
1801 struct vnode *dp = NULL; /* the directory we are searching */
1802 int wantparent; /* 1 => wantparent or lockparent flag */
1803 int rdonly; /* lookup read-only flag bit */
1804 int error = 0;
1805 #ifdef NAMEI_DIAGNOSTIC
1806 int i, newhash; /* DEBUG: check name hash */
1807 char *cp; /* DEBUG: check name ptr/len */
1808 #endif
1809 vfs_context_t ctx = cnp->cn_context;
1810
1811 /*
1812 * Setup: break out flag bits into variables.
1813 */
1814 wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT);
1815 rdonly = cnp->cn_flags & RDONLY;
1816 cnp->cn_flags &= ~ISSYMLINK;
1817
1818 if (cnp->cn_flags & NOCACHE) {
1819 cnp->cn_flags &= ~MAKEENTRY;
1820 } else {
1821 cnp->cn_flags |= MAKEENTRY;
1822 }
1823
1824 dp = dvp;
1825
1826 /*
1827 * Check for degenerate name (e.g. / or "")
1828 * which is a way of talking about a directory,
1829 * e.g. like "/." or ".".
1830 */
1831 if (cnp->cn_nameptr[0] == '\0') {
1832 if (cnp->cn_nameiop != LOOKUP || wantparent) {
1833 error = EISDIR;
1834 goto bad;
1835 }
1836 if (dp->v_type != VDIR) {
1837 error = ENOTDIR;
1838 goto bad;
1839 }
1840 if ((vnode_get(dp))) {
1841 error = ENOENT;
1842 goto bad;
1843 }
1844 *vpp = dp;
1845
1846 if (cnp->cn_flags & SAVESTART) {
1847 panic("lookup: SAVESTART");
1848 }
1849 return 0;
1850 }
1851 /*
1852 * We now have a segment name to search for, and a directory to search.
1853 */
1854 if ((error = VNOP_LOOKUP(dp, vpp, cnp, ctx))) {
1855 if (error != EJUSTRETURN) {
1856 goto bad;
1857 }
1858 #if DIAGNOSTIC
1859 if (*vpp != NULL) {
1860 panic("leaf should be empty");
1861 }
1862 #endif
1863 /*
1864 * If creating and at end of pathname, then can consider
1865 * allowing file to be created.
1866 */
1867 if (rdonly) {
1868 error = EROFS;
1869 goto bad;
1870 }
1871 /*
1872 * We return with ni_vp NULL to indicate that the entry
1873 * doesn't currently exist, leaving a pointer to the
1874 * (possibly locked) directory inode in ndp->ni_dvp.
1875 */
1876 return 0;
1877 }
1878 dp = *vpp;
1879
1880 #if DIAGNOSTIC
1881 /*
1882 * Check for symbolic link
1883 */
1884 if (dp->v_type == VLNK && (cnp->cn_flags & FOLLOW)) {
1885 panic("relookup: symlink found.");
1886 }
1887 #endif
1888
1889 /*
1890 * Disallow directory write attempts on read-only file systems.
1891 */
1892 if (rdonly &&
1893 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) {
1894 error = EROFS;
1895 goto bad2;
1896 }
1897 /* ASSERT(dvp == ndp->ni_startdir) */
1898
1899 return 0;
1900
1901 bad2:
1902 vnode_put(dp);
1903 bad:
1904 *vpp = NULL;
1905
1906 return error;
1907 }
1908
1909 /*
1910 * Free pathname buffer
1911 */
1912 void
1913 nameidone(struct nameidata *ndp)
1914 {
1915 if (ndp->ni_cnd.cn_flags & HASBUF) {
1916 char *tmp = ndp->ni_cnd.cn_pnbuf;
1917
1918 ndp->ni_cnd.cn_pnbuf = NULL;
1919 ndp->ni_cnd.cn_flags &= ~HASBUF;
1920 zfree(ZV_NAMEI, tmp);
1921 }
1922 }
1923
1924
1925 /*
1926 * Log (part of) a pathname using kdebug, as used by fs_usage. The path up to
1927 * and including the current component name are logged. Up to NUMPARMS * 4
1928 * bytes of pathname will be logged. If the path to be logged is longer than
1929 * that, then the last NUMPARMS * 4 bytes are logged. That is, the truncation
1930 * removes the leading portion of the path.
1931 *
1932 * The logging is done via multiple KDBG_RELEASE calls. The first one is marked
1933 * with DBG_FUNC_START. The last one is marked with DBG_FUNC_END (in addition
1934 * to DBG_FUNC_START if it is also the first). There may be intermediate ones
1935 * with neither DBG_FUNC_START nor DBG_FUNC_END.
1936 *
1937 * The first event passes the vnode pointer and 24 or 32 (on K32, 12 or 24)
1938 * bytes of pathname. The remaining events add 32 (on K32, 16) bytes of
1939 * pathname each. The minimum number of events required to pass the path are
1940 * used. Any excess padding in the final event (because not all of the 24 or 32
1941 * (on K32, 12 or 16) bytes are needed for the remainder of the path) is set to
1942 * zero bytes, or '>' if there is more path beyond the current component name
1943 * (usually because an intermediate component was not found).
1944 *
1945 * NOTE: If the path length is greater than NUMPARMS * 4, or is not of the form
1946 * 24 + N * 32 (or on K32, 12 + N * 16), there will be no padding.
1947 */
1948 #if (KDEBUG_LEVEL >= KDEBUG_LEVEL_IST)
1949
1950 void
1951 kdebug_vfs_lookup(unsigned long *path_words, int path_len, void *vnp,
1952 uint32_t flags)
1953 {
1954 bool noprocfilt = flags & KDBG_VFS_LOOKUP_FLAG_NOPROCFILT;
1955
1956 assert(path_len >= 0);
1957
1958 int code = ((flags & KDBG_VFS_LOOKUP_FLAG_LOOKUP) ? VFS_LOOKUP :
1959 VFS_LOOKUP_DONE) | DBG_FUNC_START;
1960
1961 if (path_len <= (3 * (int)sizeof(long))) {
1962 code |= DBG_FUNC_END;
1963 }
1964
1965 if (noprocfilt) {
1966 KDBG_RELEASE_NOPROCFILT(code, kdebug_vnode(vnp), path_words[0],
1967 path_words[1], path_words[2]);
1968 } else {
1969 KDBG_RELEASE(code, kdebug_vnode(vnp), path_words[0], path_words[1],
1970 path_words[2]);
1971 }
1972
1973 code &= ~DBG_FUNC_START;
1974
1975 for (int i = 3; i * (int)sizeof(long) < path_len; i += 4) {
1976 if ((i + 4) * (int)sizeof(long) >= path_len) {
1977 code |= DBG_FUNC_END;
1978 }
1979
1980 if (noprocfilt) {
1981 KDBG_RELEASE_NOPROCFILT(code, path_words[i], path_words[i + 1],
1982 path_words[i + 2], path_words[i + 3]);
1983 } else {
1984 KDBG_RELEASE(code, path_words[i], path_words[i + 1],
1985 path_words[i + 2], path_words[i + 3]);
1986 }
1987 }
1988 }
1989
1990 void
1991 kdebug_lookup_gen_events(long *path_words, int path_len, void *vnp, bool lookup)
1992 {
1993 assert(path_len >= 0);
1994 kdebug_vfs_lookup((unsigned long *)path_words, path_len, vnp,
1995 lookup ? KDBG_VFS_LOOKUP_FLAG_LOOKUP : 0);
1996 }
1997
1998 void
1999 kdebug_lookup(vnode_t vnp, struct componentname *cnp)
2000 {
2001 unsigned long path_words[NUMPARMS];
2002
2003 /*
2004 * Truncate the leading portion of the path to fit in path_words.
2005 */
2006 char *path_end = cnp->cn_nameptr + cnp->cn_namelen;
2007 size_t path_len = MIN(path_end - cnp->cn_pnbuf,
2008 (ssize_t)sizeof(path_words));
2009 assert(path_len >= 0);
2010 char *path_trunc = path_end - path_len;
2011
2012 memcpy(path_words, path_trunc, path_len);
2013
2014 /*
2015 * Pad with '\0' or '>'.
2016 */
2017 if (path_len < (ssize_t)sizeof(path_words)) {
2018 bool complete_str = *(cnp->cn_nameptr + cnp->cn_namelen) == '\0';
2019 memset((char *)path_words + path_len, complete_str ? '\0' : '>',
2020 sizeof(path_words) - path_len);
2021 }
2022 kdebug_vfs_lookup(path_words, (int)path_len, vnp, KDBG_VFS_LOOKUP_FLAG_LOOKUP);
2023 }
2024
2025 #else /* (KDEBUG_LEVEL >= KDEBUG_LEVEL_IST) */
2026
2027 void
2028 kdebug_vfs_lookup(long *dbg_parms __unused, int dbg_namelen __unused,
2029 void *dp __unused, __unused uint32_t flags)
2030 {
2031 }
2032
2033 static void
2034 kdebug_lookup(struct vnode *dp __unused, struct componentname *cnp __unused)
2035 {
2036 }
2037 #endif /* (KDEBUG_LEVEL >= KDEBUG_LEVEL_IST) */
2038
2039 int
2040 vfs_getbyid(fsid_t *fsid, ino64_t ino, vnode_t *vpp, vfs_context_t ctx)
2041 {
2042 mount_t mp;
2043 int error;
2044
2045 mp = mount_lookupby_volfsid(fsid->val[0], 1);
2046 if (mp == NULL) {
2047 return EINVAL;
2048 }
2049
2050 /* Get the target vnode. */
2051 if (ino == 2) {
2052 error = VFS_ROOT(mp, vpp, ctx);
2053 } else {
2054 error = VFS_VGET(mp, ino, vpp, ctx);
2055 }
2056
2057 vfs_unbusy(mp);
2058 return error;
2059 }
2060 /*
2061 * Obtain the real path from a legacy volfs style path.
2062 *
2063 * Valid formats of input path:
2064 *
2065 * "555/@"
2066 * "555/2"
2067 * "555/123456"
2068 * "555/123456/foobar"
2069 *
2070 * Where:
2071 * 555 represents the volfs file system id
2072 * '@' and '2' are aliases to the root of a file system
2073 * 123456 represents a file id
2074 * "foobar" represents a file name
2075 */
2076 #if CONFIG_VOLFS
2077 static int
2078 vfs_getrealpath(const char * path, char * realpath, size_t bufsize, vfs_context_t ctx)
2079 {
2080 vnode_t vp;
2081 struct mount *mp = NULL;
2082 char *str;
2083 char ch;
2084 unsigned long id;
2085 ino64_t ino;
2086 int error;
2087 int length;
2088
2089 /* Get file system id and move str to next component. */
2090 id = strtoul(path, &str, 10);
2091 if (id == 0 || str[0] != '/') {
2092 return EINVAL;
2093 }
2094 while (*str == '/') {
2095 str++;
2096 }
2097 ch = *str;
2098
2099 if (id > INT_MAX) {
2100 return ENOENT;
2101 }
2102 mp = mount_lookupby_volfsid((int)id, 1);
2103 if (mp == NULL) {
2104 return EINVAL; /* unexpected failure */
2105 }
2106 /* Check for an alias to a file system root. */
2107 if (ch == '@' && str[1] == '\0') {
2108 ino = 2;
2109 str++;
2110 } else {
2111 /* Get file id and move str to next component. */
2112 ino = strtouq(str, &str, 10);
2113 }
2114
2115 /* Get the target vnode. */
2116 if (ino == 2) {
2117 struct vfs_attr vfsattr;
2118 int use_vfs_root = TRUE;
2119
2120 VFSATTR_INIT(&vfsattr);
2121 VFSATTR_WANTED(&vfsattr, f_capabilities);
2122 if (vfs_getattr(mp, &vfsattr, vfs_context_kernel()) == 0 &&
2123 VFSATTR_IS_SUPPORTED(&vfsattr, f_capabilities)) {
2124 if ((vfsattr.f_capabilities.capabilities[VOL_CAPABILITIES_FORMAT] & VOL_CAP_FMT_VOL_GROUPS) &&
2125 (vfsattr.f_capabilities.valid[VOL_CAPABILITIES_FORMAT] & VOL_CAP_FMT_VOL_GROUPS)) {
2126 use_vfs_root = FALSE;
2127 }
2128 }
2129
2130 if (use_vfs_root) {
2131 error = VFS_ROOT(mp, &vp, ctx);
2132 } else {
2133 error = VFS_VGET(mp, ino, &vp, ctx);
2134 }
2135 } else {
2136 error = VFS_VGET(mp, ino, &vp, ctx);
2137 }
2138 vfs_unbusy(mp);
2139 if (error) {
2140 goto out;
2141 }
2142 realpath[0] = '\0';
2143
2144 /* Get the absolute path to this vnode. */
2145 error = build_path(vp, realpath, (int)bufsize, &length, 0, ctx);
2146 vnode_put(vp);
2147
2148 if (error == 0 && *str != '\0') {
2149 size_t attempt = strlcat(realpath, str, MAXPATHLEN);
2150 if (attempt > MAXPATHLEN) {
2151 error = ENAMETOOLONG;
2152 }
2153 }
2154 out:
2155 return error;
2156 }
2157 #endif
2158
2159 void
2160 lookup_compound_vnop_post_hook(int error, vnode_t dvp, vnode_t vp, struct nameidata *ndp, int did_create)
2161 {
2162 if (error == 0 && vp == NULLVP) {
2163 panic("NULL vp with error == 0.");
2164 }
2165
2166 /*
2167 * We don't want to do any of this if we didn't use the compound vnop
2168 * to perform the lookup... i.e. if we're allowing and using the legacy pattern,
2169 * where we did a full lookup.
2170 */
2171 if ((ndp->ni_flag & NAMEI_COMPOUND_OP_MASK) == 0) {
2172 return;
2173 }
2174
2175 /*
2176 * If we're going to continue the lookup, we'll handle
2177 * all lookup-related updates at that time.
2178 */
2179 if (error == EKEEPLOOKING) {
2180 return;
2181 }
2182
2183 /*
2184 * Only audit or update cache for *found* vnodes. For creation
2185 * neither would happen in the non-compound-vnop case.
2186 */
2187 if ((vp != NULLVP) && !did_create) {
2188 /*
2189 * If MAKEENTRY isn't set, and we've done a successful compound VNOP,
2190 * then we certainly don't want to update cache or identity.
2191 */
2192 if ((error != 0) || (ndp->ni_cnd.cn_flags & MAKEENTRY)) {
2193 lookup_consider_update_cache(dvp, vp, &ndp->ni_cnd, ndp->ni_ncgeneration);
2194 }
2195 if (ndp->ni_cnd.cn_flags & AUDITVNPATH1) {
2196 AUDIT_ARG(vnpath, vp, ARG_VNODE1);
2197 } else if (ndp->ni_cnd.cn_flags & AUDITVNPATH2) {
2198 AUDIT_ARG(vnpath, vp, ARG_VNODE2);
2199 }
2200 }
2201
2202 /*
2203 * If you created (whether you opened or not), cut a lookup tracepoint
2204 * for the parent dir (as would happen without a compound vnop). Note: we may need
2205 * a vnode despite failure in this case!
2206 *
2207 * If you did not create:
2208 * Found child (succeeded or not): cut a tracepoint for the child.
2209 * Did not find child: cut a tracepoint with the parent.
2210 */
2211 if (kdebug_enable) {
2212 kdebug_lookup(vp ? vp : dvp, &ndp->ni_cnd);
2213 }
2214 }
2215