1 /*
2 * Copyright (c) 2000-2015 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /* Copyright (c) 1995 NeXT Computer, Inc. All Rights Reserved */
29 /*
30 * Copyright (c) 1982, 1986, 1989, 1993
31 * The Regents of the University of California. All rights reserved.
32 * (c) UNIX System Laboratories, Inc.
33 * All or some portions of this file are derived from material licensed
34 * to the University of California by American Telephone and Telegraph
35 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
36 * the permission of UNIX System Laboratories, Inc.
37 *
38 * Redistribution and use in source and binary forms, with or without
39 * modification, are permitted provided that the following conditions
40 * are met:
41 * 1. Redistributions of source code must retain the above copyright
42 * notice, this list of conditions and the following disclaimer.
43 * 2. Redistributions in binary form must reproduce the above copyright
44 * notice, this list of conditions and the following disclaimer in the
45 * documentation and/or other materials provided with the distribution.
46 * 3. All advertising materials mentioning features or use of this software
47 * must display the following acknowledgement:
48 * This product includes software developed by the University of
49 * California, Berkeley and its contributors.
50 * 4. Neither the name of the University nor the names of its contributors
51 * may be used to endorse or promote products derived from this software
52 * without specific prior written permission.
53 *
54 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
55 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
56 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
57 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
58 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
59 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
60 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
61 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
62 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
63 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
64 * SUCH DAMAGE.
65 *
66 * @(#)vfs_lookup.c 8.10 (Berkeley) 5/27/95
67 */
68 /*
69 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
70 * support for mandatory and extensible security protections. This notice
71 * is included in support of clause 2.2 (b) of the Apple Public License,
72 * Version 2.0.
73 */
74
75 #include <sys/param.h>
76 #include <sys/systm.h>
77 #include <sys/syslimits.h>
78 #include <sys/time.h>
79 #include <sys/namei.h>
80 #include <sys/vm.h>
81 #include <sys/vnode_internal.h>
82 #include <sys/mount_internal.h>
83 #include <sys/errno.h>
84 #include <kern/kalloc.h>
85 #include <sys/filedesc.h>
86 #include <sys/proc_internal.h>
87 #include <sys/kdebug.h>
88 #include <sys/unistd.h> /* For _PC_NAME_MAX */
89 #include <sys/uio_internal.h>
90 #include <sys/kauth.h>
91 #include <kern/zalloc.h>
92 #include <security/audit/audit.h>
93 #if CONFIG_MACF
94 #include <security/mac_framework.h>
95 #endif
96 #include <os/atomic_private.h>
97
98 #include <sys/paths.h>
99
100 #if NAMEDRSRCFORK
101 #include <sys/xattr.h>
102 #endif
103 /*
104 * The minimum volfs-style pathname is 9.
105 * Example: "/.vol/1/2"
106 */
107 #define VOLFS_MIN_PATH_LEN 9
108
109
110 #if CONFIG_VOLFS
111 static int vfs_getrealpath(const char * path, char * realpath, size_t bufsize, vfs_context_t ctx);
112 #define MAX_VOLFS_RESTARTS 5
113 #endif
114
115 static int lookup_traverse_mountpoints(struct nameidata *ndp, struct componentname *cnp, vnode_t dp, int vbusyflags, vfs_context_t ctx);
116 static int lookup_handle_symlink(struct nameidata *ndp, vnode_t *new_dp, bool* dp_has_iocount, vfs_context_t ctx);
117 static int lookup_authorize_search(vnode_t dp, struct componentname *cnp, int dp_authorized_in_cache, vfs_context_t ctx);
118 static void lookup_consider_update_cache(vnode_t dvp, vnode_t vp, struct componentname *cnp, int nc_generation);
119 static int lookup_handle_found_vnode(struct nameidata *ndp, struct componentname *cnp, int rdonly,
120 int vbusyflags, int *keep_going, int nc_generation,
121 int wantparent, int atroot, vfs_context_t ctx);
122 static int lookup_handle_emptyname(struct nameidata *ndp, struct componentname *cnp, int wantparent);
123
124 #if NAMEDRSRCFORK
125 static int lookup_handle_rsrc_fork(vnode_t dp, struct nameidata *ndp, struct componentname *cnp, int wantparent, vfs_context_t ctx);
126 #endif
127
128 extern lck_rw_t rootvnode_rw_lock;
129
130 #define RESOLVE_NOFOLLOW_ANY 0x00000001
131 #define RESOLVE_CHECKED 0x80000000
132 static int lookup_check_for_resolve_prefix(char *path, size_t pathbuflen, size_t len, uint32_t *resolve_flags, size_t *prefix_len);
133
134 /*
135 * Convert a pathname into a pointer to a locked inode.
136 *
137 * The FOLLOW flag is set when symbolic links are to be followed
138 * when they occur at the end of the name translation process.
139 * Symbolic links are always followed for all other pathname
140 * components other than the last.
141 *
142 * The segflg defines whether the name is to be copied from user
143 * space or kernel space.
144 *
145 * Overall outline of namei:
146 *
147 * copy in name
148 * get starting directory
149 * while (!done && !error) {
150 * call lookup to search path.
151 * if symbolic link, massage name in buffer and continue
152 * }
153 *
154 * Returns: 0 Success
155 * ENOENT No such file or directory
156 * ELOOP Too many levels of symbolic links
157 * ENAMETOOLONG Filename too long
158 * copyinstr:EFAULT Bad address
159 * copyinstr:ENAMETOOLONG Filename too long
160 * lookup:EBADF Bad file descriptor
161 * lookup:EROFS
162 * lookup:EACCES
163 * lookup:EPERM
164 * lookup:ERECYCLE vnode was recycled from underneath us in lookup.
165 * This means we should re-drive lookup from this point.
166 * lookup: ???
167 * VNOP_READLINK:???
168 */
169 int
namei(struct nameidata * ndp)170 namei(struct nameidata *ndp)
171 {
172 struct vnode *dp; /* the directory we are searching */
173 struct vnode *usedvp = ndp->ni_dvp; /* store pointer to vp in case we must loop due to
174 * heavy vnode pressure */
175 uint32_t cnpflags = ndp->ni_cnd.cn_flags; /* store in case we have to restore after loop */
176 int error;
177 struct componentname *cnp = &ndp->ni_cnd;
178 vfs_context_t ctx = cnp->cn_context;
179 proc_t p = vfs_context_proc(ctx);
180 #if CONFIG_AUDIT
181 /* XXX ut should be from context */
182 uthread_t ut = current_uthread();
183 #endif
184
185 #if CONFIG_VOLFS
186 int volfs_restarts = 0;
187 #endif
188 size_t bytes_copied = 0;
189 size_t resolve_prefix_len = 0;
190 vnode_t rootdir_with_usecount = NULLVP;
191 vnode_t startdir_with_usecount = NULLVP;
192 vnode_t usedvp_dp = NULLVP;
193 int32_t old_count = 0;
194 uint32_t resolve_flags = 0;
195 int resolve_error = 0;
196 bool dp_has_iocount = false;
197
198 #if DIAGNOSTIC
199 if (!vfs_context_ucred(ctx) || !p) {
200 panic("namei: bad cred/proc");
201 }
202 if (cnp->cn_nameiop & (~OPMASK)) {
203 panic("namei: nameiop contaminated with flags");
204 }
205 if (cnp->cn_flags & OPMASK) {
206 panic("namei: flags contaminated with nameiops");
207 }
208 #endif
209
210 /*
211 * A compound VNOP found something that needs further processing:
212 * either a trigger vnode, a covered directory, or a symlink.
213 */
214 if (ndp->ni_flag & NAMEI_CONTLOOKUP) {
215 int rdonly, vbusyflags, keep_going, wantparent;
216
217 rdonly = cnp->cn_flags & RDONLY;
218 vbusyflags = ((cnp->cn_flags & CN_NBMOUNTLOOK) != 0) ? LK_NOWAIT : 0;
219 keep_going = 0;
220 wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT);
221
222 ndp->ni_flag &= ~(NAMEI_CONTLOOKUP);
223
224 error = lookup_handle_found_vnode(ndp, &ndp->ni_cnd, rdonly, vbusyflags,
225 &keep_going, ndp->ni_ncgeneration, wantparent, 0, ctx);
226 if (error) {
227 goto out_drop;
228 }
229 if (keep_going) {
230 if ((cnp->cn_flags & ISSYMLINK) == 0) {
231 panic("We need to keep going on a continued lookup, but for vp type %d (tag %d)", ndp->ni_vp->v_type, ndp->ni_vp->v_tag);
232 }
233 goto continue_symlink;
234 }
235
236 return 0;
237 }
238
239 vnode_recycled:
240
241 /*
242 * Get a buffer for the name to be translated, and copy the
243 * name into the buffer.
244 */
245 if ((cnp->cn_flags & HASBUF) == 0) {
246 cnp->cn_pnbuf = ndp->ni_pathbuf;
247 cnp->cn_pnlen = PATHBUFLEN;
248 }
249
250 retry_copy:
251 if (UIO_SEG_IS_USER_SPACE(ndp->ni_segflg)) {
252 error = copyinstr(ndp->ni_dirp, cnp->cn_pnbuf,
253 cnp->cn_pnlen, &bytes_copied);
254 } else {
255 error = copystr(CAST_DOWN(void *, ndp->ni_dirp), cnp->cn_pnbuf,
256 cnp->cn_pnlen, &bytes_copied);
257 }
258 if (error == ENAMETOOLONG && !(cnp->cn_flags & HASBUF)) {
259 if (bytes_copied == PATHBUFLEN) {
260 resolve_error = lookup_check_for_resolve_prefix(cnp->cn_pnbuf, PATHBUFLEN,
261 PATHBUFLEN, &resolve_flags, &resolve_prefix_len);
262 /* errors from copyinstr take precedence over resolve_error */
263 if (!resolve_error && resolve_prefix_len) {
264 ndp->ni_dirp += resolve_prefix_len;
265 resolve_prefix_len = 0;
266 }
267 }
268
269 cnp->cn_pnbuf = zalloc(ZV_NAMEI);
270 cnp->cn_flags |= HASBUF;
271 cnp->cn_pnlen = MAXPATHLEN;
272 bytes_copied = 0;
273
274 goto retry_copy;
275 }
276 if (error) {
277 goto error_out;
278 } else if (resolve_error) {
279 error = resolve_error;
280 goto error_out;
281 }
282 assert(bytes_copied <= MAXPATHLEN);
283 ndp->ni_pathlen = (u_int)bytes_copied;
284 bytes_copied = 0;
285
286 if (!(resolve_flags & RESOLVE_CHECKED)) {
287 assert(!(cnp->cn_flags & HASBUF) && (cnp->cn_pnlen == PATHBUFLEN));
288 error = lookup_check_for_resolve_prefix(cnp->cn_pnbuf, cnp->cn_pnlen, ndp->ni_pathlen,
289 &resolve_flags, &resolve_prefix_len);
290 if (error) {
291 goto error_out;
292 }
293 if (resolve_prefix_len) {
294 /*
295 * Since this is pointing to the static path buffer instead of a zalloc'ed memorry,
296 * we're not going to attempt to free this, so it is perfectly fine to change the
297 * value of cnp->cn_pnbuf.
298 */
299 cnp->cn_pnbuf += resolve_prefix_len;
300 cnp->cn_pnlen -= resolve_prefix_len;
301 ndp->ni_pathlen -= resolve_prefix_len;
302 resolve_prefix_len = 0;
303 }
304 }
305
306 /* At this point we should have stripped off the prefix from the path that has to be looked up */
307 assert((resolve_flags & RESOLVE_CHECKED) && (resolve_prefix_len == 0));
308
309 /*
310 * Since the name cache may contain positive entries of
311 * the incorrect case, force lookup() to bypass the cache
312 * and call directly into the filesystem for each path
313 * component. Note: the FS may still consult the cache,
314 * but can apply rules to validate the results.
315 */
316 if (proc_is_forcing_hfs_case_sensitivity(p)) {
317 cnp->cn_flags |= CN_SKIPNAMECACHE;
318 }
319
320 #if CONFIG_VOLFS
321 /*
322 * Check for legacy volfs style pathnames.
323 *
324 * For compatibility reasons we currently allow these paths,
325 * but future versions of the OS may not support them.
326 */
327 if (ndp->ni_pathlen >= VOLFS_MIN_PATH_LEN &&
328 cnp->cn_pnbuf[0] == '/' &&
329 cnp->cn_pnbuf[1] == '.' &&
330 cnp->cn_pnbuf[2] == 'v' &&
331 cnp->cn_pnbuf[3] == 'o' &&
332 cnp->cn_pnbuf[4] == 'l' &&
333 cnp->cn_pnbuf[5] == '/') {
334 char * realpath;
335 int realpath_err;
336 /* Attempt to resolve a legacy volfs style pathname. */
337 realpath = zalloc(ZV_NAMEI);
338 /*
339 * We only error out on the ENAMETOOLONG cases where we know that
340 * vfs_getrealpath translation succeeded but the path could not fit into
341 * MAXPATHLEN characters. In other failure cases, we may be dealing with a path
342 * that legitimately looks like /.vol/1234/567 and is not meant to be translated
343 */
344 if ((realpath_err = vfs_getrealpath(&cnp->cn_pnbuf[6], realpath, MAXPATHLEN, ctx))) {
345 zfree(ZV_NAMEI, realpath);
346 if (realpath_err == ENOSPC || realpath_err == ENAMETOOLONG) {
347 error = ENAMETOOLONG;
348 goto error_out;
349 }
350 } else {
351 size_t tmp_len;
352 if (cnp->cn_flags & HASBUF) {
353 zfree(ZV_NAMEI, cnp->cn_pnbuf);
354 }
355 cnp->cn_pnbuf = realpath;
356 cnp->cn_pnlen = MAXPATHLEN;
357 tmp_len = strlen(realpath) + 1;
358 assert(tmp_len <= UINT_MAX);
359 ndp->ni_pathlen = (u_int)tmp_len;
360 cnp->cn_flags |= HASBUF | CN_VOLFSPATH;
361 }
362 }
363 #endif /* CONFIG_VOLFS */
364
365 #if CONFIG_AUDIT
366 /* If we are auditing the kernel pathname, save the user pathname */
367 if (cnp->cn_flags & AUDITVNPATH1) {
368 AUDIT_ARG(upath, ut->uu_cdir, cnp->cn_pnbuf, ARG_UPATH1);
369 }
370 if (cnp->cn_flags & AUDITVNPATH2) {
371 AUDIT_ARG(upath, ut->uu_cdir, cnp->cn_pnbuf, ARG_UPATH2);
372 }
373 #endif /* CONFIG_AUDIT */
374
375 /*
376 * Do not allow empty pathnames
377 */
378 if (*cnp->cn_pnbuf == '\0') {
379 error = ENOENT;
380 goto error_out;
381 }
382 if (ndp->ni_flag & NAMEI_NOFOLLOW_ANY || (resolve_flags & RESOLVE_NOFOLLOW_ANY)) {
383 ndp->ni_loopcnt = MAXSYMLINKS;
384 } else {
385 ndp->ni_loopcnt = 0;
386 }
387
388 /*
389 * determine the starting point for the translation.
390 */
391 proc_dirs_lock_shared(p);
392 lck_rw_lock_shared(&rootvnode_rw_lock);
393
394 if (!(ndp->ni_flag & NAMEI_ROOTDIR)) {
395 if (fdt_flag_test(&p->p_fd, FD_CHROOT)) {
396 ndp->ni_rootdir = p->p_fd.fd_rdir;
397 } else {
398 ndp->ni_rootdir = rootvnode;
399 }
400 }
401
402 if (!ndp->ni_rootdir) {
403 if (ndp->ni_flag & NAMEI_ROOTDIR) {
404 panic("NAMEI_ROOTDIR is set but ni_rootdir is not\n");
405 } else if (fdt_flag_test(&p->p_fd, FD_CHROOT)) {
406 /* This should be a panic */
407 printf("p->p_fd.fd_rdir is not set\n");
408 } else {
409 printf("rootvnode is not set\n");
410 }
411 lck_rw_unlock_shared(&rootvnode_rw_lock);
412 proc_dirs_unlock_shared(p);
413 error = ENOENT;
414 goto error_out;
415 }
416
417 cnp->cn_nameptr = cnp->cn_pnbuf;
418
419 ndp->ni_usedvp = NULLVP;
420
421 if (*(cnp->cn_nameptr) == '/') {
422 while (*(cnp->cn_nameptr) == '/') {
423 cnp->cn_nameptr++;
424 ndp->ni_pathlen--;
425 }
426 dp = ndp->ni_rootdir;
427 } else if (cnp->cn_flags & USEDVP) {
428 dp = ndp->ni_dvp;
429 ndp->ni_usedvp = dp;
430 usedvp_dp = dp;
431 } else {
432 dp = vfs_context_cwd(ctx);
433 }
434
435 if (dp == NULLVP || (dp->v_lflag & VL_DEAD)) {
436 dp = NULLVP;
437 lck_rw_unlock_shared(&rootvnode_rw_lock);
438 proc_dirs_unlock_shared(p);
439 error = ENOENT;
440 goto error_out;
441 }
442
443 /*
444 * We need our own usecount on the root vnode and the starting dir across
445 * the lookup. There's two things that be done here. We can hold the locks
446 * (which protect the existing usecounts on the directories) across the
447 * lookup or take our own usecount. Holding the locks across the lookup can
448 * cause deadlock issues if we re-enter namei on the same thread so the
449 * correct thing to do is to acquire our own usecount.
450 *
451 * Ideally, the usecount should be obtained by vnode_get->vnode_ref->vnode_put.
452 * However when this vnode is the rootvnode, that sequence will produce a
453 * lot of vnode mutex locks and unlocks on a single vnode (the rootvnode)
454 * and will be highly contended and degrade performance. Since we have
455 * an existing usecount protected by the locks we hold, we'll just use
456 * an atomic op to increment the usecount on a vnode which already has one
457 * and can't be released because we have the locks which protect against that
458 * happening.
459 */
460 rootdir_with_usecount = ndp->ni_rootdir;
461 old_count = os_atomic_inc_orig(&rootdir_with_usecount->v_usecount, relaxed);
462 if (old_count < 1) {
463 panic("(1) invalid pre-increment usecount (%d) for rootdir vnode %p",
464 old_count, rootdir_with_usecount);
465 } else if (old_count == INT32_MAX) {
466 panic("(1) usecount overflow for vnode %p", rootdir_with_usecount);
467 }
468
469 if ((dp != rootdir_with_usecount) && (dp != usedvp_dp)) {
470 old_count = os_atomic_inc_orig(&dp->v_usecount, relaxed);
471 if (old_count < 1) {
472 panic("(2) invalid pre-increment usecount (%d) for vnode %p", old_count, dp);
473 } else if (old_count == INT32_MAX) {
474 panic("(2) usecount overflow for vnode %p", dp);
475 }
476 startdir_with_usecount = dp;
477 }
478
479 /* Now that we have our usecount, release the locks */
480 lck_rw_unlock_shared(&rootvnode_rw_lock);
481 proc_dirs_unlock_shared(p);
482
483 ndp->ni_dvp = NULLVP;
484 ndp->ni_vp = NULLVP;
485
486 for (;;) {
487 #if CONFIG_MACF
488 /*
489 * Give MACF policies a chance to reject the lookup
490 * before performing any filesystem operations.
491 * This hook is called before resolving the path and
492 * again each time a symlink is encountered.
493 * NB: policies receive path information as supplied
494 * by the caller and thus cannot be trusted.
495 */
496 error = mac_vnode_check_lookup_preflight(ctx, dp, cnp->cn_nameptr, cnp->cn_namelen);
497 if (error) {
498 goto error_out;
499 }
500 #endif
501 ndp->ni_startdir = dp;
502 dp = NULLVP;
503
504 if ((error = lookup(ndp))) {
505 goto error_out;
506 }
507
508 /*
509 * Check for symbolic link
510 */
511 if ((cnp->cn_flags & ISSYMLINK) == 0) {
512 if (startdir_with_usecount) {
513 vnode_rele(startdir_with_usecount);
514 startdir_with_usecount = NULLVP;
515 }
516 if (rootdir_with_usecount) {
517 lck_rw_lock_shared(&rootvnode_rw_lock);
518 if (rootdir_with_usecount == rootvnode) {
519 old_count = os_atomic_dec_orig(&rootdir_with_usecount->v_usecount, relaxed);
520 if (old_count < 2) {
521 /*
522 * There needs to have been at least 1 usecount left on the rootvnode
523 */
524 panic("(3) Unexpected pre-decrement value (%d) of usecount for rootvnode %p",
525 old_count, rootdir_with_usecount);
526 }
527 rootdir_with_usecount = NULLVP;
528 }
529 lck_rw_unlock_shared(&rootvnode_rw_lock);
530 if (rootdir_with_usecount) {
531 vnode_rele(rootdir_with_usecount);
532 rootdir_with_usecount = NULLVP;
533 }
534 }
535
536 return 0;
537 }
538
539 continue_symlink:
540 /* Gives us a new path to process, and a starting dir */
541 error = lookup_handle_symlink(ndp, &dp, &dp_has_iocount, ctx);
542 if (error != 0) {
543 break;
544 }
545 if (dp_has_iocount) {
546 if ((dp != rootdir_with_usecount) && (dp != startdir_with_usecount) &&
547 (dp != usedvp_dp)) {
548 if (startdir_with_usecount) {
549 vnode_rele(startdir_with_usecount);
550 }
551 vnode_ref_ext(dp, 0, VNODE_REF_FORCE);
552 startdir_with_usecount = dp;
553 }
554 vnode_put(dp);
555 dp_has_iocount = false;
556 }
557 }
558 /*
559 * only come here if we fail to handle a SYMLINK...
560 * if either ni_dvp or ni_vp is non-NULL, then
561 * we need to drop the iocount that was picked
562 * up in the lookup routine
563 */
564 out_drop:
565 if (ndp->ni_dvp) {
566 vnode_put(ndp->ni_dvp);
567 }
568 if (ndp->ni_vp) {
569 vnode_put(ndp->ni_vp);
570 }
571 error_out:
572 if (startdir_with_usecount) {
573 vnode_rele(startdir_with_usecount);
574 startdir_with_usecount = NULLVP;
575 }
576 if (rootdir_with_usecount) {
577 lck_rw_lock_shared(&rootvnode_rw_lock);
578 if (rootdir_with_usecount == rootvnode) {
579 old_count = os_atomic_dec_orig(&rootdir_with_usecount->v_usecount, relaxed);
580 if (old_count < 2) {
581 /*
582 * There needs to have been at least 1 usecount left on the rootvnode
583 */
584 panic("(4) Unexpected pre-decrement value (%d) of usecount for rootvnode %p",
585 old_count, rootdir_with_usecount);
586 }
587 lck_rw_unlock_shared(&rootvnode_rw_lock);
588 } else {
589 lck_rw_unlock_shared(&rootvnode_rw_lock);
590 vnode_rele(rootdir_with_usecount);
591 }
592 rootdir_with_usecount = NULLVP;
593 }
594
595 if ((cnp->cn_flags & HASBUF)) {
596 cnp->cn_flags &= ~HASBUF;
597 zfree(ZV_NAMEI, cnp->cn_pnbuf);
598 }
599 cnp->cn_pnbuf = NULL;
600 ndp->ni_vp = NULLVP;
601 ndp->ni_dvp = NULLVP;
602
603 #if CONFIG_VOLFS
604 /*
605 * Deal with volfs fallout.
606 *
607 * At this point, if we were originally given a volfs path that
608 * looks like /.vol/123/456, then we would have had to convert it into
609 * a full path. Assuming that part worked properly, we will now attempt
610 * to conduct a lookup of the item in the namespace. Under normal
611 * circumstances, if a user looked up /tmp/foo and it was not there, it
612 * would be permissible to return ENOENT.
613 *
614 * However, we may not want to do that here. Specifically, the volfs path
615 * uniquely identifies a certain item in the namespace regardless of where it
616 * lives. If the item has moved in between the time we constructed the
617 * path and now, when we're trying to do a lookup/authorization on the full
618 * path, we may have gotten an ENOENT.
619 *
620 * At this point we can no longer tell if the path no longer exists
621 * or if the item in question no longer exists. It could have been renamed
622 * away, in which case the /.vol identifier is still valid.
623 *
624 * Do this dance a maximum of MAX_VOLFS_RESTARTS times.
625 */
626 if ((error == ENOENT) && (ndp->ni_cnd.cn_flags & CN_VOLFSPATH)) {
627 if (volfs_restarts < MAX_VOLFS_RESTARTS) {
628 volfs_restarts++;
629 goto vnode_recycled;
630 }
631 }
632 #endif
633
634 if (error == ERECYCLE) {
635 /* vnode was recycled underneath us. re-drive lookup to start at
636 * the beginning again, since recycling invalidated last lookup*/
637 ndp->ni_cnd.cn_flags = cnpflags;
638 ndp->ni_dvp = usedvp;
639 goto vnode_recycled;
640 }
641
642
643 return error;
644 }
645
646 int
namei_compound_available(vnode_t dp,struct nameidata * ndp)647 namei_compound_available(vnode_t dp, struct nameidata *ndp)
648 {
649 if ((ndp->ni_flag & NAMEI_COMPOUNDOPEN) != 0) {
650 return vnode_compound_open_available(dp);
651 }
652
653 return 0;
654 }
655
656 static int
lookup_check_for_resolve_prefix(char * path,size_t pathbuflen,size_t len,uint32_t * resolve_flags,size_t * prefix_len)657 lookup_check_for_resolve_prefix(char *path, size_t pathbuflen, size_t len, uint32_t *resolve_flags, size_t *prefix_len)
658 {
659 int error = 0;
660 *resolve_flags = (uint32_t)RESOLVE_CHECKED;
661 *prefix_len = 0;
662
663 if (len < (sizeof("/.nofollow/") - 1) || path[0] != '/' || path[1] != '.') {
664 return 0;
665 }
666
667 if ((strncmp(&path[2], "nofollow/", (sizeof("nofollow/") - 1)) == 0)) {
668 *resolve_flags |= RESOLVE_NOFOLLOW_ANY;
669 *prefix_len = sizeof("/.nofollow") - 1;
670 } else if ((len >= sizeof("/.resolve/1/") - 1) &&
671 strncmp(&path[2], "resolve/", (sizeof("resolve/") - 1)) == 0) {
672 char * flag = path + (sizeof("/.resolve/") - 1);
673 char *next = flag;
674 char last_char = path[pathbuflen - 1];
675
676 /* no leading zeroes or non digits */
677 if ((flag[0] == '0' && flag[1] != '/') ||
678 flag[0] < '0' || flag[0] > '9') {
679 error = EINVAL;
680 goto out;
681 }
682
683 path[pathbuflen - 1] = '\0';
684 unsigned long flag_val = strtoul(flag, &next, 10);
685 path[pathbuflen - 1] = last_char;
686 if (next[0] != '/' || (flag_val & ~(RESOLVE_NOFOLLOW_ANY))) {
687 error = EINVAL;
688 goto out;
689 }
690 assert(next >= flag);
691 *resolve_flags |= (uint32_t)flag_val;
692 *prefix_len = (size_t)(next - path);
693 }
694 out:
695 assert(*prefix_len <= sizeof("/.resolve/2147483647"));
696 return error;
697 }
698
699 static int
lookup_authorize_search(vnode_t dp,struct componentname * cnp,int dp_authorized_in_cache,vfs_context_t ctx)700 lookup_authorize_search(vnode_t dp, struct componentname *cnp, int dp_authorized_in_cache, vfs_context_t ctx)
701 {
702 #if !CONFIG_MACF
703 #pragma unused(cnp)
704 #endif
705
706 int error;
707
708 if (!dp_authorized_in_cache) {
709 error = vnode_authorize(dp, NULL, KAUTH_VNODE_SEARCH, ctx);
710 if (error) {
711 return error;
712 }
713 }
714 #if CONFIG_MACF
715 error = mac_vnode_check_lookup(ctx, dp, cnp);
716 if (error) {
717 return error;
718 }
719 #endif /* CONFIG_MACF */
720
721 return 0;
722 }
723
724 static void
lookup_consider_update_cache(vnode_t dvp,vnode_t vp,struct componentname * cnp,int nc_generation)725 lookup_consider_update_cache(vnode_t dvp, vnode_t vp, struct componentname *cnp, int nc_generation)
726 {
727 int isdot_or_dotdot;
728 isdot_or_dotdot = (cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.') || (cnp->cn_flags & ISDOTDOT);
729
730 if (vp->v_name == NULL || vp->v_parent == NULLVP) {
731 int update_flags = 0;
732
733 if (isdot_or_dotdot == 0) {
734 if (vp->v_name == NULL) {
735 update_flags |= VNODE_UPDATE_NAME;
736 }
737 if (dvp != NULLVP && vp->v_parent == NULLVP) {
738 update_flags |= VNODE_UPDATE_PARENT;
739 }
740
741 if (update_flags) {
742 vnode_update_identity(vp, dvp, cnp->cn_nameptr, cnp->cn_namelen, cnp->cn_hash, update_flags);
743 }
744 }
745 }
746 if ((cnp->cn_flags & MAKEENTRY) && (vp->v_flag & VNCACHEABLE) && LIST_FIRST(&vp->v_nclinks) == NULL) {
747 /*
748 * missing from name cache, but should
749 * be in it... this can happen if volfs
750 * causes the vnode to be created or the
751 * name cache entry got recycled but the
752 * vnode didn't...
753 * check to make sure that ni_dvp is valid
754 * cache_lookup_path may return a NULL
755 * do a quick check to see if the generation of the
756 * directory matches our snapshot... this will get
757 * rechecked behind the name cache lock, but if it
758 * already fails to match, no need to go any further
759 */
760 if (dvp != NULLVP && (nc_generation == dvp->v_nc_generation) && (!isdot_or_dotdot)) {
761 cache_enter_with_gen(dvp, vp, cnp, nc_generation);
762 }
763 }
764 }
765
766 #if NAMEDRSRCFORK
767 /*
768 * Can change ni_dvp and ni_vp. On success, returns with iocounts on stream vnode (always) and
769 * data fork if requested. On failure, returns with iocount data fork (always) and its parent directory
770 * (if one was provided).
771 */
772 static int
lookup_handle_rsrc_fork(vnode_t dp,struct nameidata * ndp,struct componentname * cnp,int wantparent,vfs_context_t ctx)773 lookup_handle_rsrc_fork(vnode_t dp, struct nameidata *ndp, struct componentname *cnp, int wantparent, vfs_context_t ctx)
774 {
775 vnode_t svp = NULLVP;
776 enum nsoperation nsop;
777 int nsflags;
778 int error;
779
780 if (dp->v_type != VREG) {
781 error = ENOENT;
782 goto out;
783 }
784 switch (cnp->cn_nameiop) {
785 case DELETE:
786 if (cnp->cn_flags & CN_ALLOWRSRCFORK) {
787 nsop = NS_DELETE;
788 } else {
789 error = EPERM;
790 goto out;
791 }
792 break;
793 case CREATE:
794 if (cnp->cn_flags & CN_ALLOWRSRCFORK) {
795 nsop = NS_CREATE;
796 } else {
797 error = EPERM;
798 goto out;
799 }
800 break;
801 case LOOKUP:
802 /* Make sure our lookup of "/..namedfork/rsrc" is allowed. */
803 if (cnp->cn_flags & CN_ALLOWRSRCFORK) {
804 nsop = NS_OPEN;
805 } else {
806 error = EPERM;
807 goto out;
808 }
809 break;
810 default:
811 error = EPERM;
812 goto out;
813 }
814
815 nsflags = 0;
816 if (cnp->cn_flags & CN_RAW_ENCRYPTED) {
817 nsflags |= NS_GETRAWENCRYPTED;
818 }
819
820 /* Ask the file system for the resource fork. */
821 error = vnode_getnamedstream(dp, &svp, XATTR_RESOURCEFORK_NAME, nsop, nsflags, ctx);
822
823 /* During a create, it OK for stream vnode to be missing. */
824 if (error == ENOATTR || error == ENOENT) {
825 error = (nsop == NS_CREATE) ? 0 : ENOENT;
826 }
827 if (error) {
828 goto out;
829 }
830 /* The "parent" of the stream is the file. */
831 if (wantparent) {
832 if (ndp->ni_dvp) {
833 vnode_put(ndp->ni_dvp);
834 }
835 ndp->ni_dvp = dp;
836 } else {
837 vnode_put(dp);
838 }
839 ndp->ni_vp = svp; /* on create this may be null */
840
841 /* Restore the truncated pathname buffer (for audits). */
842 if (ndp->ni_pathlen == 1 && ndp->ni_next[0] == '\0') {
843 /*
844 * While we replaced only '/' with '\0' and would ordinarily
845 * need to just switch that back, the buffer in which we did
846 * this may not be what the pathname buffer is now when symlinks
847 * are involved. If we just restore the "/" we will make the
848 * string not terminated anymore, so be safe and restore the
849 * entire suffix.
850 */
851 strncpy(ndp->ni_next, _PATH_RSRCFORKSPEC, sizeof(_PATH_RSRCFORKSPEC));
852 cnp->cn_nameptr = ndp->ni_next + 1;
853 cnp->cn_namelen = sizeof(_PATH_RSRCFORKSPEC) - 1;
854 ndp->ni_next += cnp->cn_namelen;
855 if (ndp->ni_next[0] != '\0') {
856 panic("Incorrect termination of path in %s", __FUNCTION__);
857 }
858 }
859 cnp->cn_flags &= ~MAKEENTRY;
860
861 return 0;
862 out:
863 return error;
864 }
865 #endif /* NAMEDRSRCFORK */
866
867 /*
868 * iocounts in:
869 * --One on ni_vp. One on ni_dvp if there is more path, or we didn't come through the
870 * cache, or we came through the cache and the caller doesn't want the parent.
871 *
872 * iocounts out:
873 * --Leaves us in the correct state for the next step, whatever that might be.
874 * --If we find a symlink, returns with iocounts on both ni_vp and ni_dvp.
875 * --If we are to look up another component, then we have an iocount on ni_vp and
876 * nothing else.
877 * --If we are done, returns an iocount on ni_vp, and possibly on ni_dvp depending on nameidata flags.
878 * --In the event of an error, may return with ni_dvp NULL'ed out (in which case, iocount
879 * was dropped).
880 */
881 static int
lookup_handle_found_vnode(struct nameidata * ndp,struct componentname * cnp,int rdonly,int vbusyflags,int * keep_going,int nc_generation,int wantparent,int atroot,vfs_context_t ctx)882 lookup_handle_found_vnode(struct nameidata *ndp, struct componentname *cnp, int rdonly,
883 int vbusyflags, int *keep_going, int nc_generation,
884 int wantparent, int atroot, vfs_context_t ctx)
885 {
886 vnode_t dp;
887 int error;
888 char *cp;
889
890 dp = ndp->ni_vp;
891 *keep_going = 0;
892
893 if (ndp->ni_vp == NULLVP) {
894 panic("NULL ni_vp in %s", __FUNCTION__);
895 }
896
897 if (atroot) {
898 goto nextname;
899 }
900
901 /*
902 * Take into account any additional components consumed by
903 * the underlying filesystem.
904 */
905 if (cnp->cn_consume > 0) {
906 cnp->cn_nameptr += cnp->cn_consume;
907 ndp->ni_next += cnp->cn_consume;
908 ndp->ni_pathlen -= cnp->cn_consume;
909 cnp->cn_consume = 0;
910 } else {
911 lookup_consider_update_cache(ndp->ni_dvp, dp, cnp, nc_generation);
912 }
913
914 /*
915 * Check to see if the vnode has been mounted on...
916 * if so find the root of the mounted file system.
917 * Updates ndp->ni_vp.
918 */
919 error = lookup_traverse_mountpoints(ndp, cnp, dp, vbusyflags, ctx);
920 dp = ndp->ni_vp;
921 if (error) {
922 goto out;
923 }
924
925 #if CONFIG_MACF
926 if (vfs_flags(vnode_mount(dp)) & MNT_MULTILABEL) {
927 error = vnode_label(vnode_mount(dp), NULL, dp, NULL, 0, ctx);
928 if (error) {
929 goto out;
930 }
931 }
932 #endif
933
934 /*
935 * Check for symbolic link
936 */
937 if ((dp->v_type == VLNK) &&
938 ((cnp->cn_flags & FOLLOW) || (ndp->ni_flag & NAMEI_TRAILINGSLASH) || *ndp->ni_next == '/')) {
939 cnp->cn_flags |= ISSYMLINK;
940 *keep_going = 1;
941 return 0;
942 }
943
944 /*
945 * Check for bogus trailing slashes.
946 */
947 if ((ndp->ni_flag & NAMEI_TRAILINGSLASH)) {
948 if (dp->v_type != VDIR) {
949 error = ENOTDIR;
950 goto out;
951 }
952 ndp->ni_flag &= ~(NAMEI_TRAILINGSLASH);
953 }
954
955 #if NAMEDSTREAMS
956 /*
957 * Deny namei/lookup requests to resolve paths that point to shadow files.
958 * Access to shadow files must be conducted by explicit calls to VNOP_LOOKUP
959 * directly, and not use lookup/namei
960 */
961 if (vnode_isshadow(dp)) {
962 error = ENOENT;
963 goto out;
964 }
965 #endif
966
967 nextname:
968 /*
969 * Not a symbolic link. If more pathname,
970 * continue at next component, else return.
971 *
972 * Definitely have a dvp if there's another slash
973 */
974 if (*ndp->ni_next == '/') {
975 cnp->cn_nameptr = ndp->ni_next + 1;
976 ndp->ni_pathlen--;
977 while (*cnp->cn_nameptr == '/') {
978 cnp->cn_nameptr++;
979 ndp->ni_pathlen--;
980 }
981
982 cp = cnp->cn_nameptr;
983 vnode_put(ndp->ni_dvp);
984 ndp->ni_dvp = NULLVP;
985
986 if (*cp == '\0') {
987 goto emptyname;
988 }
989
990 *keep_going = 1;
991 return 0;
992 }
993
994 /*
995 * Disallow directory write attempts on read-only file systems.
996 */
997 if (rdonly &&
998 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) {
999 error = EROFS;
1000 goto out;
1001 }
1002
1003 /* If SAVESTART is set, we should have a dvp */
1004 if (cnp->cn_flags & SAVESTART) {
1005 /*
1006 * note that we already hold a reference
1007 * on both dp and ni_dvp, but for some reason
1008 * can't get another one... in this case we
1009 * need to do vnode_put on dp in 'bad2'
1010 */
1011 if ((vnode_get(ndp->ni_dvp))) {
1012 error = ENOENT;
1013 goto out;
1014 }
1015 ndp->ni_startdir = ndp->ni_dvp;
1016 }
1017 if (!wantparent && ndp->ni_dvp) {
1018 vnode_put(ndp->ni_dvp);
1019 ndp->ni_dvp = NULLVP;
1020 }
1021
1022 if (cnp->cn_flags & AUDITVNPATH1) {
1023 AUDIT_ARG(vnpath, dp, ARG_VNODE1);
1024 } else if (cnp->cn_flags & AUDITVNPATH2) {
1025 AUDIT_ARG(vnpath, dp, ARG_VNODE2);
1026 }
1027
1028 #if NAMEDRSRCFORK
1029 /*
1030 * Caller wants the resource fork.
1031 */
1032 if ((cnp->cn_flags & CN_WANTSRSRCFORK) && (dp != NULLVP)) {
1033 error = lookup_handle_rsrc_fork(dp, ndp, cnp, wantparent, ctx);
1034 if (error != 0) {
1035 goto out;
1036 }
1037
1038 dp = ndp->ni_vp;
1039 }
1040 #endif
1041 if (kdebug_enable) {
1042 kdebug_lookup(ndp->ni_vp, cnp);
1043 }
1044
1045 return 0;
1046
1047 emptyname:
1048 error = lookup_handle_emptyname(ndp, cnp, wantparent);
1049 if (error != 0) {
1050 goto out;
1051 }
1052
1053 return 0;
1054 out:
1055 return error;
1056 }
1057
1058 /*
1059 * Comes in iocount on ni_vp. May overwrite ni_dvp, but doesn't interpret incoming value.
1060 */
1061 static int
lookup_handle_emptyname(struct nameidata * ndp,struct componentname * cnp,int wantparent)1062 lookup_handle_emptyname(struct nameidata *ndp, struct componentname *cnp, int wantparent)
1063 {
1064 vnode_t dp;
1065 int error = 0;
1066
1067 dp = ndp->ni_vp;
1068 cnp->cn_namelen = 0;
1069 /*
1070 * A degenerate name (e.g. / or "") which is a way of
1071 * talking about a directory, e.g. like "/." or ".".
1072 */
1073 if (dp->v_type != VDIR) {
1074 error = ENOTDIR;
1075 goto out;
1076 }
1077 if (cnp->cn_nameiop == CREATE && dp == rootvnode) {
1078 error = EEXIST;
1079 goto out;
1080 }
1081 if (cnp->cn_nameiop != LOOKUP) {
1082 error = EISDIR;
1083 goto out;
1084 }
1085 if (wantparent) {
1086 /*
1087 * note that we already hold a reference
1088 * on dp, but for some reason can't
1089 * get another one... in this case we
1090 * need to do vnode_put on dp in 'bad'
1091 */
1092 if ((vnode_get(dp))) {
1093 error = ENOENT;
1094 goto out;
1095 }
1096 ndp->ni_dvp = dp;
1097 }
1098 cnp->cn_flags &= ~ISDOTDOT;
1099 cnp->cn_flags |= ISLASTCN;
1100 ndp->ni_next = cnp->cn_nameptr;
1101 ndp->ni_vp = dp;
1102
1103 if (cnp->cn_flags & AUDITVNPATH1) {
1104 AUDIT_ARG(vnpath, dp, ARG_VNODE1);
1105 } else if (cnp->cn_flags & AUDITVNPATH2) {
1106 AUDIT_ARG(vnpath, dp, ARG_VNODE2);
1107 }
1108 if (cnp->cn_flags & SAVESTART) {
1109 panic("lookup: SAVESTART");
1110 }
1111
1112 return 0;
1113 out:
1114 return error;
1115 }
1116 /*
1117 * Search a pathname.
1118 * This is a very central and rather complicated routine.
1119 *
1120 * The pathname is pointed to by ni_ptr and is of length ni_pathlen.
1121 * The starting directory is taken from ni_startdir. The pathname is
1122 * descended until done, or a symbolic link is encountered. The variable
1123 * ni_more is clear if the path is completed; it is set to one if a
1124 * symbolic link needing interpretation is encountered.
1125 *
1126 * The flag argument is LOOKUP, CREATE, RENAME, or DELETE depending on
1127 * whether the name is to be looked up, created, renamed, or deleted.
1128 * When CREATE, RENAME, or DELETE is specified, information usable in
1129 * creating, renaming, or deleting a directory entry may be calculated.
1130 * If flag has LOCKPARENT or'ed into it, the parent directory is returned
1131 * locked. If flag has WANTPARENT or'ed into it, the parent directory is
1132 * returned unlocked. Otherwise the parent directory is not returned. If
1133 * the target of the pathname exists and LOCKLEAF is or'ed into the flag
1134 * the target is returned locked, otherwise it is returned unlocked.
1135 * When creating or renaming and LOCKPARENT is specified, the target may not
1136 * be ".". When deleting and LOCKPARENT is specified, the target may be ".".
1137 *
1138 * Overall outline of lookup:
1139 *
1140 * dirloop:
1141 * identify next component of name at ndp->ni_ptr
1142 * handle degenerate case where name is null string
1143 * if .. and crossing mount points and on mounted filesys, find parent
1144 * call VNOP_LOOKUP routine for next component name
1145 * directory vnode returned in ni_dvp, unlocked unless LOCKPARENT set
1146 * component vnode returned in ni_vp (if it exists), locked.
1147 * if result vnode is mounted on and crossing mount points,
1148 * find mounted on vnode
1149 * if more components of name, do next level at dirloop
1150 * return the answer in ni_vp, locked if LOCKLEAF set
1151 * if LOCKPARENT set, return locked parent in ni_dvp
1152 * if WANTPARENT set, return unlocked parent in ni_dvp
1153 *
1154 * Returns: 0 Success
1155 * ENOENT No such file or directory
1156 * EBADF Bad file descriptor
1157 * ENOTDIR Not a directory
1158 * EROFS Read-only file system [CREATE]
1159 * EISDIR Is a directory [CREATE]
1160 * cache_lookup_path:ERECYCLE (vnode was recycled from underneath us, redrive lookup again)
1161 * vnode_authorize:EROFS
1162 * vnode_authorize:EACCES
1163 * vnode_authorize:EPERM
1164 * vnode_authorize:???
1165 * VNOP_LOOKUP:ENOENT No such file or directory
1166 * VNOP_LOOKUP:EJUSTRETURN Restart system call (INTERNAL)
1167 * VNOP_LOOKUP:???
1168 * VFS_ROOT:ENOTSUP
1169 * VFS_ROOT:ENOENT
1170 * VFS_ROOT:???
1171 */
1172 int
lookup(struct nameidata * ndp)1173 lookup(struct nameidata *ndp)
1174 {
1175 char *cp; /* pointer into pathname argument */
1176 vnode_t tdp; /* saved dp */
1177 vnode_t dp; /* the directory we are searching */
1178 int docache = 1; /* == 0 do not cache last component */
1179 int wantparent; /* 1 => wantparent or lockparent flag */
1180 int rdonly; /* lookup read-only flag bit */
1181 int dp_authorized = 0;
1182 int error = 0;
1183 struct componentname *cnp = &ndp->ni_cnd;
1184 vfs_context_t ctx = cnp->cn_context;
1185 int vbusyflags = 0;
1186 int nc_generation = 0;
1187 vnode_t last_dp = NULLVP;
1188 int keep_going;
1189 int atroot;
1190
1191 /*
1192 * Setup: break out flag bits into variables.
1193 */
1194 if (cnp->cn_flags & NOCACHE) {
1195 docache = 0;
1196 }
1197 wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT);
1198 rdonly = cnp->cn_flags & RDONLY;
1199 cnp->cn_flags &= ~ISSYMLINK;
1200 cnp->cn_consume = 0;
1201
1202 dp = ndp->ni_startdir;
1203 ndp->ni_startdir = NULLVP;
1204
1205 if ((cnp->cn_flags & CN_NBMOUNTLOOK) != 0) {
1206 vbusyflags = LK_NOWAIT;
1207 }
1208 cp = cnp->cn_nameptr;
1209
1210 if (*cp == '\0') {
1211 if ((vnode_getwithref(dp))) {
1212 dp = NULLVP;
1213 error = ENOENT;
1214 goto bad;
1215 }
1216 ndp->ni_vp = dp;
1217 error = lookup_handle_emptyname(ndp, cnp, wantparent);
1218 if (error) {
1219 goto bad;
1220 }
1221
1222 return 0;
1223 }
1224 dirloop:
1225 atroot = 0;
1226 ndp->ni_vp = NULLVP;
1227
1228 if ((error = cache_lookup_path(ndp, cnp, dp, ctx, &dp_authorized, last_dp))) {
1229 dp = NULLVP;
1230 goto bad;
1231 }
1232 if ((cnp->cn_flags & ISLASTCN)) {
1233 if (docache) {
1234 cnp->cn_flags |= MAKEENTRY;
1235 }
1236 } else {
1237 cnp->cn_flags |= MAKEENTRY;
1238 }
1239
1240 dp = ndp->ni_dvp;
1241
1242 if (ndp->ni_vp != NULLVP) {
1243 /*
1244 * cache_lookup_path returned a non-NULL ni_vp then,
1245 * we're guaranteed that the dp is a VDIR, it's
1246 * been authorized, and vp is not ".."
1247 *
1248 * make sure we don't try to enter the name back into
1249 * the cache if this vp is purged before we get to that
1250 * check since we won't have serialized behind whatever
1251 * activity is occurring in the FS that caused the purge
1252 */
1253 if (dp != NULLVP) {
1254 nc_generation = dp->v_nc_generation - 1;
1255 }
1256
1257 goto returned_from_lookup_path;
1258 }
1259
1260 /*
1261 * Handle "..": two special cases.
1262 * 1. If at root directory (e.g. after chroot)
1263 * or at absolute root directory
1264 * then ignore it so can't get out.
1265 * 2. If this vnode is the root of a mounted
1266 * filesystem, then replace it with the
1267 * vnode which was mounted on so we take the
1268 * .. in the other file system.
1269 */
1270 if ((cnp->cn_flags & ISDOTDOT)) {
1271 /*
1272 * if this is a chroot'ed process, check if the current
1273 * directory is still a subdirectory of the process's
1274 * root directory.
1275 */
1276 if (ndp->ni_rootdir && (ndp->ni_rootdir != rootvnode) &&
1277 dp != ndp->ni_rootdir) {
1278 int sdir_error;
1279 int is_subdir = FALSE;
1280
1281 sdir_error = vnode_issubdir(dp, ndp->ni_rootdir,
1282 &is_subdir, vfs_context_kernel());
1283
1284 /*
1285 * If we couldn't determine if dp is a subdirectory of
1286 * ndp->ni_rootdir (sdir_error != 0), we let the request
1287 * proceed.
1288 */
1289 if (!sdir_error && !is_subdir) {
1290 vnode_put(dp);
1291 dp = ndp->ni_rootdir;
1292 /*
1293 * There's a ref on the process's root directory
1294 * but we can't use vnode_getwithref here as
1295 * there is nothing preventing that ref being
1296 * released by another thread.
1297 */
1298 if (vnode_get(dp)) {
1299 error = ENOENT;
1300 goto bad;
1301 }
1302 }
1303 }
1304
1305 for (;;) {
1306 if (dp == ndp->ni_rootdir || dp == rootvnode) {
1307 ndp->ni_dvp = dp;
1308 ndp->ni_vp = dp;
1309 /*
1310 * we're pinned at the root
1311 * we've already got one reference on 'dp'
1312 * courtesy of cache_lookup_path... take
1313 * another one for the ".."
1314 * if we fail to get the new reference, we'll
1315 * drop our original down in 'bad'
1316 */
1317 if ((vnode_get(dp))) {
1318 error = ENOENT;
1319 goto bad;
1320 }
1321 atroot = 1;
1322 goto returned_from_lookup_path;
1323 }
1324 if ((dp->v_flag & VROOT) == 0 ||
1325 (cnp->cn_flags & NOCROSSMOUNT)) {
1326 break;
1327 }
1328 if (dp->v_mount == NULL) { /* forced umount */
1329 error = EBADF;
1330 goto bad;
1331 }
1332 tdp = dp;
1333 dp = tdp->v_mount->mnt_vnodecovered;
1334
1335 if ((vnode_getwithref(dp))) {
1336 vnode_put(tdp);
1337 dp = NULLVP;
1338 error = ENOENT;
1339 goto bad;
1340 }
1341
1342 vnode_put(tdp);
1343
1344 ndp->ni_dvp = dp;
1345 dp_authorized = 0;
1346 }
1347 }
1348
1349 /*
1350 * We now have a segment name to search for, and a directory to search.
1351 */
1352 #if CONFIG_UNION_MOUNTS
1353 unionlookup:
1354 #endif /* CONFIG_UNION_MOUNTS */
1355 ndp->ni_vp = NULLVP;
1356
1357 if (dp->v_type != VDIR) {
1358 error = ENOTDIR;
1359 goto lookup_error;
1360 }
1361 if ((cnp->cn_flags & DONOTAUTH) != DONOTAUTH) {
1362 error = lookup_authorize_search(dp, cnp, dp_authorized, ctx);
1363 if (error) {
1364 goto lookup_error;
1365 }
1366 }
1367
1368 /*
1369 * Now that we've authorized a lookup, can bail out if the filesystem
1370 * will be doing a batched operation. Return an iocount on dvp.
1371 */
1372 #if NAMEDRSRCFORK
1373 if ((cnp->cn_flags & ISLASTCN) && namei_compound_available(dp, ndp) && !(cnp->cn_flags & CN_WANTSRSRCFORK)) {
1374 #else
1375 if ((cnp->cn_flags & ISLASTCN) && namei_compound_available(dp, ndp)) {
1376 #endif /* NAMEDRSRCFORK */
1377 ndp->ni_flag |= NAMEI_UNFINISHED;
1378 ndp->ni_ncgeneration = dp->v_nc_generation;
1379 return 0;
1380 }
1381
1382 nc_generation = dp->v_nc_generation;
1383
1384 /*
1385 * Note:
1386 * Filesystems that support hardlinks may want to call vnode_update_identity
1387 * if the lookup operation below will modify the in-core vnode to belong to a new point
1388 * in the namespace. VFS cannot infer whether or not the look up operation makes the vnode
1389 * name change or change parents. Without this, the lookup may make update
1390 * filesystem-specific in-core metadata but fail to update the v_parent or v_name
1391 * fields in the vnode. If VFS were to do this, it would be necessary to call
1392 * vnode_update_identity on every lookup operation -- expensive!
1393 *
1394 * However, even with this in place, multiple lookups may occur in between this lookup
1395 * and the subsequent vnop, so, at best, we could only guarantee that you would get a
1396 * valid path back, and not necessarily the one that you wanted.
1397 *
1398 * Example:
1399 * /tmp/a == /foo/b
1400 *
1401 * If you are now looking up /foo/b and the vnode for this link represents /tmp/a,
1402 * vnode_update_identity will fix the parentage so that you can get /foo/b back
1403 * through the v_parent chain (preventing you from getting /tmp/b back). It would
1404 * not fix whether or not you should or should not get /tmp/a vs. /foo/b.
1405 */
1406
1407 error = VNOP_LOOKUP(dp, &ndp->ni_vp, cnp, ctx);
1408
1409 if (error) {
1410 lookup_error:
1411 #if CONFIG_UNION_MOUNTS
1412 if ((error == ENOENT) &&
1413 (dp->v_mount != NULL) &&
1414 (dp->v_mount->mnt_flag & MNT_UNION)) {
1415 tdp = dp;
1416 error = lookup_traverse_union(tdp, &dp, ctx);
1417 vnode_put(tdp);
1418 if (error) {
1419 dp = NULLVP;
1420 goto bad;
1421 }
1422
1423 ndp->ni_dvp = dp;
1424 dp_authorized = 0;
1425 goto unionlookup;
1426 }
1427 #endif /* CONFIG_UNION_MOUNTS */
1428
1429 if (error != EJUSTRETURN) {
1430 goto bad;
1431 }
1432
1433 if (ndp->ni_vp != NULLVP) {
1434 panic("leaf should be empty");
1435 }
1436
1437 #if NAMEDRSRCFORK
1438 /*
1439 * At this point, error should be EJUSTRETURN.
1440 *
1441 * If CN_WANTSRSRCFORK is set, that implies that the
1442 * underlying filesystem could not find the "parent" of the
1443 * resource fork (the data fork), and we are doing a lookup
1444 * for a CREATE event.
1445 *
1446 * However, this should be converted to an error, as the
1447 * failure to find this parent should disallow further
1448 * progress to try and acquire a resource fork vnode.
1449 */
1450 if (cnp->cn_flags & CN_WANTSRSRCFORK) {
1451 error = ENOENT;
1452 goto bad;
1453 }
1454 #endif
1455
1456 error = lookup_validate_creation_path(ndp);
1457 if (error) {
1458 goto bad;
1459 }
1460 /*
1461 * We return with ni_vp NULL to indicate that the entry
1462 * doesn't currently exist, leaving a pointer to the
1463 * referenced directory vnode in ndp->ni_dvp.
1464 */
1465 if (cnp->cn_flags & SAVESTART) {
1466 if ((vnode_get(ndp->ni_dvp))) {
1467 error = ENOENT;
1468 goto bad;
1469 }
1470 ndp->ni_startdir = ndp->ni_dvp;
1471 }
1472 if (!wantparent) {
1473 vnode_put(ndp->ni_dvp);
1474 }
1475
1476 if (kdebug_enable) {
1477 kdebug_lookup(ndp->ni_dvp, cnp);
1478 }
1479 return 0;
1480 }
1481 returned_from_lookup_path:
1482 /* We'll always have an iocount on ni_vp when this finishes. */
1483 error = lookup_handle_found_vnode(ndp, cnp, rdonly, vbusyflags, &keep_going, nc_generation, wantparent, atroot, ctx);
1484 if (error != 0) {
1485 goto bad2;
1486 }
1487
1488 if (keep_going) {
1489 dp = ndp->ni_vp;
1490
1491 /* namei() will handle symlinks */
1492 if ((dp->v_type == VLNK) &&
1493 ((cnp->cn_flags & FOLLOW) || (ndp->ni_flag & NAMEI_TRAILINGSLASH) || *ndp->ni_next == '/')) {
1494 return 0;
1495 }
1496
1497 /*
1498 * Otherwise, there's more path to process.
1499 * cache_lookup_path is now responsible for dropping io ref on dp
1500 * when it is called again in the dirloop. This ensures we hold
1501 * a ref on dp until we complete the next round of lookup.
1502 */
1503 last_dp = dp;
1504
1505 goto dirloop;
1506 }
1507
1508 return 0;
1509 bad2:
1510 if (ndp->ni_dvp) {
1511 vnode_put(ndp->ni_dvp);
1512 }
1513
1514 vnode_put(ndp->ni_vp);
1515 ndp->ni_vp = NULLVP;
1516
1517 if (kdebug_enable) {
1518 kdebug_lookup(dp, cnp);
1519 }
1520 return error;
1521
1522 bad:
1523 if (dp) {
1524 vnode_put(dp);
1525 }
1526 ndp->ni_vp = NULLVP;
1527
1528 if (kdebug_enable) {
1529 kdebug_lookup(dp, cnp);
1530 }
1531 return error;
1532 }
1533
1534 #if CONFIG_UNION_MOUNTS
1535 /*
1536 * Given a vnode in a union mount, traverse to the equivalent
1537 * vnode in the underlying mount.
1538 */
1539 int
1540 lookup_traverse_union(vnode_t dvp, vnode_t *new_dvp, vfs_context_t ctx)
1541 {
1542 char *path = NULL, *pp;
1543 const char *name, *np;
1544 size_t len;
1545 int error = 0;
1546 struct nameidata nd;
1547 vnode_t vp = dvp;
1548
1549 *new_dvp = NULL;
1550
1551 if (vp && vp->v_flag & VROOT) {
1552 *new_dvp = vp->v_mount->mnt_vnodecovered;
1553 if (vnode_getwithref(*new_dvp)) {
1554 return ENOENT;
1555 }
1556 return 0;
1557 }
1558
1559 path = zalloc_flags(ZV_NAMEI, Z_WAITOK | Z_NOFAIL);
1560
1561 /*
1562 * Walk back up to the mountpoint following the
1563 * v_parent chain and build a slash-separated path.
1564 * Then lookup that path starting with the covered vnode.
1565 */
1566 pp = path + (MAXPATHLEN - 1);
1567 *pp = '\0';
1568
1569 while (1) {
1570 name = vnode_getname(vp);
1571 if (name == NULL) {
1572 printf("lookup_traverse_union: null parent name: .%s\n", pp);
1573 error = ENOENT;
1574 goto done;
1575 }
1576 len = strlen(name);
1577 if ((len + 1) > (size_t)(pp - path)) { // Enough space for this name ?
1578 error = ENAMETOOLONG;
1579 vnode_putname(name);
1580 goto done;
1581 }
1582 for (np = name + len; len > 0; len--) { // Copy name backwards
1583 *--pp = *--np;
1584 }
1585 vnode_putname(name);
1586 vp = vp->v_parent;
1587 if (vp == NULLVP || vp->v_flag & VROOT) {
1588 break;
1589 }
1590 *--pp = '/';
1591 }
1592
1593 /* Evaluate the path in the underlying mount */
1594 NDINIT(&nd, LOOKUP, OP_LOOKUP, USEDVP, UIO_SYSSPACE, CAST_USER_ADDR_T(pp), ctx);
1595 nd.ni_dvp = dvp->v_mount->mnt_vnodecovered;
1596 error = namei(&nd);
1597 if (error == 0) {
1598 *new_dvp = nd.ni_vp;
1599 }
1600 nameidone(&nd);
1601 done:
1602 if (path) {
1603 zfree(ZV_NAMEI, path);
1604 }
1605 return error;
1606 }
1607 #endif /* CONFIG_UNION_MOUNTS */
1608
1609 int
1610 lookup_validate_creation_path(struct nameidata *ndp)
1611 {
1612 struct componentname *cnp = &ndp->ni_cnd;
1613
1614 /*
1615 * If creating and at end of pathname, then can consider
1616 * allowing file to be created.
1617 */
1618 if (cnp->cn_flags & RDONLY) {
1619 return EROFS;
1620 }
1621 if ((cnp->cn_flags & ISLASTCN) && (ndp->ni_flag & NAMEI_TRAILINGSLASH) && !(cnp->cn_flags & WILLBEDIR)) {
1622 return ENOENT;
1623 }
1624
1625 return 0;
1626 }
1627
1628 /*
1629 * Modifies only ni_vp. Always returns with ni_vp still valid (iocount held).
1630 */
1631 static int
1632 lookup_traverse_mountpoints(struct nameidata *ndp, struct componentname *cnp, vnode_t dp,
1633 int vbusyflags, vfs_context_t ctx)
1634 {
1635 mount_t mp;
1636 vnode_t tdp;
1637 int error = 0;
1638 uint32_t depth = 0;
1639 vnode_t mounted_on_dp;
1640 int current_mount_generation = 0;
1641 #if CONFIG_TRIGGERS
1642 vnode_t triggered_dp = NULLVP;
1643 int retry_cnt = 0;
1644 #define MAX_TRIGGER_RETRIES 1
1645 #endif
1646
1647 if (dp->v_type != VDIR || cnp->cn_flags & NOCROSSMOUNT) {
1648 return 0;
1649 }
1650
1651 mounted_on_dp = dp;
1652 #if CONFIG_TRIGGERS
1653 restart:
1654 #endif
1655 current_mount_generation = mount_generation;
1656
1657 while (dp->v_mountedhere) {
1658 vnode_lock_spin(dp);
1659 if ((mp = dp->v_mountedhere)) {
1660 mp->mnt_crossref++;
1661 vnode_unlock(dp);
1662 } else {
1663 vnode_unlock(dp);
1664 break;
1665 }
1666
1667 if (ISSET(mp->mnt_lflag, MNT_LFORCE)) {
1668 mount_dropcrossref(mp, dp, 0);
1669 break; // don't traverse into a forced unmount
1670 }
1671
1672
1673 if (vfs_busy(mp, vbusyflags)) {
1674 mount_dropcrossref(mp, dp, 0);
1675 if (vbusyflags == LK_NOWAIT) {
1676 error = ENOENT;
1677 goto out;
1678 }
1679
1680 continue;
1681 }
1682
1683 error = VFS_ROOT(mp, &tdp, ctx);
1684
1685 mount_dropcrossref(mp, dp, 0);
1686 vfs_unbusy(mp);
1687
1688 if (error) {
1689 goto out;
1690 }
1691
1692 vnode_put(dp);
1693 ndp->ni_vp = dp = tdp;
1694 if (dp->v_type != VDIR) {
1695 #if DEVELOPMENT || DEBUG
1696 panic("%s : Root of filesystem not a directory",
1697 __FUNCTION__);
1698 #else
1699 break;
1700 #endif
1701 }
1702 depth++;
1703 }
1704
1705 #if CONFIG_TRIGGERS
1706 /*
1707 * The triggered_dp check here is required but is susceptible to a
1708 * (unlikely) race in which trigger mount is done from here and is
1709 * unmounted before we get past vfs_busy above. We retry to deal with
1710 * that case but it has the side effect of unwanted retries for
1711 * "special" processes which don't want to trigger mounts.
1712 */
1713 if (dp->v_resolve && retry_cnt < MAX_TRIGGER_RETRIES) {
1714 error = vnode_trigger_resolve(dp, ndp, ctx);
1715 if (error) {
1716 goto out;
1717 }
1718 if (dp == triggered_dp) {
1719 retry_cnt += 1;
1720 } else {
1721 retry_cnt = 0;
1722 }
1723 triggered_dp = dp;
1724 goto restart;
1725 }
1726 #endif /* CONFIG_TRIGGERS */
1727
1728 if (depth) {
1729 mp = mounted_on_dp->v_mountedhere;
1730
1731 if (mp) {
1732 mount_lock_spin(mp);
1733 mp->mnt_realrootvp_vid = dp->v_id;
1734 mp->mnt_realrootvp = dp;
1735 mp->mnt_generation = current_mount_generation;
1736 mount_unlock(mp);
1737 }
1738 }
1739
1740 return 0;
1741
1742 out:
1743 return error;
1744 }
1745
1746 /*
1747 * Takes ni_vp and ni_dvp non-NULL. Returns with *new_dp set to the location
1748 * at which to start a lookup with a resolved path, and all other iocounts dropped.
1749 */
1750 static int
1751 lookup_handle_symlink(struct nameidata *ndp, vnode_t *new_dp, bool *new_dp_has_iocount, vfs_context_t ctx)
1752 {
1753 int error;
1754 char *cp; /* pointer into pathname argument */
1755 uio_t auio;
1756 UIO_STACKBUF(uio_buf, 1);
1757 int need_newpathbuf;
1758 u_int linklen = 0;
1759 struct componentname *cnp = &ndp->ni_cnd;
1760 vnode_t dp;
1761 char *tmppn;
1762 u_int rsrclen = (cnp->cn_flags & CN_WANTSRSRCFORK) ? sizeof(_PATH_RSRCFORKSPEC) : 0;
1763 bool dp_has_iocount = false;
1764
1765 if (ndp->ni_loopcnt++ >= MAXSYMLINKS) {
1766 return ELOOP;
1767 }
1768 #if CONFIG_MACF
1769 if ((error = mac_vnode_check_readlink(ctx, ndp->ni_vp)) != 0) {
1770 return error;
1771 }
1772 #endif /* MAC */
1773 if (ndp->ni_pathlen > 1 || !(cnp->cn_flags & HASBUF)) {
1774 need_newpathbuf = 1;
1775 } else {
1776 need_newpathbuf = 0;
1777 }
1778
1779 if (need_newpathbuf) {
1780 cp = zalloc(ZV_NAMEI);
1781 } else {
1782 cp = cnp->cn_pnbuf;
1783 }
1784 auio = uio_createwithbuffer(1, 0, UIO_SYSSPACE, UIO_READ, &uio_buf[0], sizeof(uio_buf));
1785
1786 uio_addiov(auio, CAST_USER_ADDR_T(cp), MAXPATHLEN);
1787
1788 error = VNOP_READLINK(ndp->ni_vp, auio, ctx);
1789
1790 if (!error) {
1791 user_ssize_t resid = uio_resid(auio);
1792
1793 assert(resid <= MAXPATHLEN);
1794
1795 if (resid == MAXPATHLEN) {
1796 linklen = 0;
1797 } else {
1798 /*
1799 * Safe to set unsigned with a [larger] signed type here
1800 * because 0 <= uio_resid <= MAXPATHLEN and MAXPATHLEN
1801 * is only 1024.
1802 */
1803 linklen = (u_int)strnlen(cp, MAXPATHLEN - (u_int)resid);
1804 }
1805
1806 if (linklen == 0) {
1807 error = ENOENT;
1808 } else if (linklen + ndp->ni_pathlen + rsrclen > MAXPATHLEN) {
1809 error = ENAMETOOLONG;
1810 }
1811 }
1812
1813 if (error) {
1814 if (need_newpathbuf) {
1815 zfree(ZV_NAMEI, cp);
1816 }
1817 return error;
1818 }
1819
1820 if (need_newpathbuf) {
1821 tmppn = cnp->cn_pnbuf;
1822 bcopy(ndp->ni_next, cp + linklen, ndp->ni_pathlen);
1823 cnp->cn_pnbuf = cp;
1824 cnp->cn_pnlen = MAXPATHLEN;
1825
1826 if ((cnp->cn_flags & HASBUF)) {
1827 zfree(ZV_NAMEI, tmppn);
1828 } else {
1829 cnp->cn_flags |= HASBUF;
1830 }
1831 } else {
1832 cnp->cn_pnbuf[linklen] = '\0';
1833 }
1834
1835 ndp->ni_pathlen += linklen;
1836 cnp->cn_nameptr = cnp->cn_pnbuf;
1837
1838 /*
1839 * starting point for 'relative'
1840 * symbolic link path
1841 */
1842 dp = ndp->ni_dvp;
1843
1844 /*
1845 * get rid of reference returned via 'lookup'
1846 * ni_dvp is released only if we restart at /.
1847 */
1848 vnode_put(ndp->ni_vp);
1849 ndp->ni_vp = NULLVP;
1850 ndp->ni_dvp = NULLVP;
1851
1852 dp_has_iocount = true;
1853
1854 /*
1855 * Check if symbolic link restarts us at the root
1856 */
1857 if (*(cnp->cn_nameptr) == '/') {
1858 while (*(cnp->cn_nameptr) == '/') {
1859 cnp->cn_nameptr++;
1860 ndp->ni_pathlen--;
1861 }
1862 if (linklen != 0) {
1863 vnode_put(dp); /* ALWAYS have a dvp for a symlink */
1864 dp_has_iocount = false;
1865 if ((dp = ndp->ni_rootdir) == NULLVP) {
1866 return ENOENT;
1867 }
1868 }
1869 }
1870
1871 *new_dp = dp;
1872 *new_dp_has_iocount = dp_has_iocount;
1873
1874 return 0;
1875 }
1876
1877 /*
1878 * relookup - lookup a path name component
1879 * Used by lookup to re-aquire things.
1880 */
1881 int
1882 relookup(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp)
1883 {
1884 struct vnode *dp = NULL; /* the directory we are searching */
1885 int wantparent; /* 1 => wantparent or lockparent flag */
1886 int rdonly; /* lookup read-only flag bit */
1887 int error = 0;
1888 #ifdef NAMEI_DIAGNOSTIC
1889 int i, newhash; /* DEBUG: check name hash */
1890 char *cp; /* DEBUG: check name ptr/len */
1891 #endif
1892 vfs_context_t ctx = cnp->cn_context;
1893
1894 /*
1895 * Setup: break out flag bits into variables.
1896 */
1897 wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT);
1898 rdonly = cnp->cn_flags & RDONLY;
1899 cnp->cn_flags &= ~ISSYMLINK;
1900
1901 if (cnp->cn_flags & NOCACHE) {
1902 cnp->cn_flags &= ~MAKEENTRY;
1903 } else {
1904 cnp->cn_flags |= MAKEENTRY;
1905 }
1906
1907 dp = dvp;
1908
1909 /*
1910 * Check for degenerate name (e.g. / or "")
1911 * which is a way of talking about a directory,
1912 * e.g. like "/." or ".".
1913 */
1914 if (cnp->cn_nameptr[0] == '\0') {
1915 if (cnp->cn_nameiop != LOOKUP || wantparent) {
1916 error = EISDIR;
1917 goto bad;
1918 }
1919 if (dp->v_type != VDIR) {
1920 error = ENOTDIR;
1921 goto bad;
1922 }
1923 if ((vnode_get(dp))) {
1924 error = ENOENT;
1925 goto bad;
1926 }
1927 *vpp = dp;
1928
1929 if (cnp->cn_flags & SAVESTART) {
1930 panic("lookup: SAVESTART");
1931 }
1932 return 0;
1933 }
1934 /*
1935 * We now have a segment name to search for, and a directory to search.
1936 */
1937 if ((error = VNOP_LOOKUP(dp, vpp, cnp, ctx))) {
1938 if (error != EJUSTRETURN) {
1939 goto bad;
1940 }
1941 #if DIAGNOSTIC
1942 if (*vpp != NULL) {
1943 panic("leaf should be empty");
1944 }
1945 #endif
1946 /*
1947 * If creating and at end of pathname, then can consider
1948 * allowing file to be created.
1949 */
1950 if (rdonly) {
1951 error = EROFS;
1952 goto bad;
1953 }
1954 /*
1955 * We return with ni_vp NULL to indicate that the entry
1956 * doesn't currently exist, leaving a pointer to the
1957 * (possibly locked) directory inode in ndp->ni_dvp.
1958 */
1959 return 0;
1960 }
1961 dp = *vpp;
1962
1963 #if DIAGNOSTIC
1964 /*
1965 * Check for symbolic link
1966 */
1967 if (dp->v_type == VLNK && (cnp->cn_flags & FOLLOW)) {
1968 panic("relookup: symlink found.");
1969 }
1970 #endif
1971
1972 /*
1973 * Disallow directory write attempts on read-only file systems.
1974 */
1975 if (rdonly &&
1976 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) {
1977 error = EROFS;
1978 goto bad2;
1979 }
1980 /* ASSERT(dvp == ndp->ni_startdir) */
1981
1982 return 0;
1983
1984 bad2:
1985 vnode_put(dp);
1986 bad:
1987 *vpp = NULL;
1988
1989 return error;
1990 }
1991
1992 /*
1993 * Free pathname buffer
1994 */
1995 void
1996 nameidone(struct nameidata *ndp)
1997 {
1998 if (ndp->ni_cnd.cn_flags & HASBUF) {
1999 char *tmp = ndp->ni_cnd.cn_pnbuf;
2000
2001 ndp->ni_cnd.cn_pnbuf = NULL;
2002 ndp->ni_cnd.cn_flags &= ~HASBUF;
2003 zfree(ZV_NAMEI, tmp);
2004 }
2005 }
2006
2007
2008 /*
2009 * Log (part of) a pathname using kdebug, as used by fs_usage. The path up to
2010 * and including the current component name are logged. Up to NUMPARMS * 4
2011 * bytes of pathname will be logged. If the path to be logged is longer than
2012 * that, then the last NUMPARMS * 4 bytes are logged. That is, the truncation
2013 * removes the leading portion of the path.
2014 *
2015 * The logging is done via multiple KDBG_RELEASE calls. The first one is marked
2016 * with DBG_FUNC_START. The last one is marked with DBG_FUNC_END (in addition
2017 * to DBG_FUNC_START if it is also the first). There may be intermediate ones
2018 * with neither DBG_FUNC_START nor DBG_FUNC_END.
2019 *
2020 * The first event passes the vnode pointer and 24 or 32 (on K32, 12 or 24)
2021 * bytes of pathname. The remaining events add 32 (on K32, 16) bytes of
2022 * pathname each. The minimum number of events required to pass the path are
2023 * used. Any excess padding in the final event (because not all of the 24 or 32
2024 * (on K32, 12 or 16) bytes are needed for the remainder of the path) is set to
2025 * zero bytes, or '>' if there is more path beyond the current component name
2026 * (usually because an intermediate component was not found).
2027 *
2028 * NOTE: If the path length is greater than NUMPARMS * 4, or is not of the form
2029 * 24 + N * 32 (or on K32, 12 + N * 16), there will be no padding.
2030 */
2031 #if (KDEBUG_LEVEL >= KDEBUG_LEVEL_IST)
2032
2033 void
2034 kdebug_vfs_lookup(unsigned long *path_words, int path_len, void *vnp,
2035 uint32_t flags)
2036 {
2037 bool noprocfilt = flags & KDBG_VFS_LOOKUP_FLAG_NOPROCFILT;
2038
2039 assert(path_len >= 0);
2040
2041 int code = ((flags & KDBG_VFS_LOOKUP_FLAG_LOOKUP) ? VFS_LOOKUP :
2042 VFS_LOOKUP_DONE) | DBG_FUNC_START;
2043
2044 if (path_len <= (3 * (int)sizeof(long))) {
2045 code |= DBG_FUNC_END;
2046 }
2047
2048 if (noprocfilt) {
2049 KDBG_RELEASE_NOPROCFILT(code, kdebug_vnode(vnp), path_words[0],
2050 path_words[1], path_words[2]);
2051 } else {
2052 KDBG_RELEASE(code, kdebug_vnode(vnp), path_words[0], path_words[1],
2053 path_words[2]);
2054 }
2055
2056 code &= ~DBG_FUNC_START;
2057
2058 for (int i = 3; i * (int)sizeof(long) < path_len; i += 4) {
2059 if ((i + 4) * (int)sizeof(long) >= path_len) {
2060 code |= DBG_FUNC_END;
2061 }
2062
2063 if (noprocfilt) {
2064 KDBG_RELEASE_NOPROCFILT(code, path_words[i], path_words[i + 1],
2065 path_words[i + 2], path_words[i + 3]);
2066 } else {
2067 KDBG_RELEASE(code, path_words[i], path_words[i + 1],
2068 path_words[i + 2], path_words[i + 3]);
2069 }
2070 }
2071 }
2072
2073 void
2074 kdebug_lookup_gen_events(long *path_words, int path_len, void *vnp, bool lookup)
2075 {
2076 assert(path_len >= 0);
2077 kdebug_vfs_lookup((unsigned long *)path_words, path_len, vnp,
2078 lookup ? KDBG_VFS_LOOKUP_FLAG_LOOKUP : 0);
2079 }
2080
2081 void
2082 kdebug_lookup(vnode_t vnp, struct componentname *cnp)
2083 {
2084 unsigned long path_words[NUMPARMS];
2085
2086 /*
2087 * Truncate the leading portion of the path to fit in path_words.
2088 */
2089 char *path_end = cnp->cn_nameptr + cnp->cn_namelen;
2090 size_t path_len = MIN(path_end - cnp->cn_pnbuf,
2091 (ssize_t)sizeof(path_words));
2092 assert(path_len >= 0);
2093 char *path_trunc = path_end - path_len;
2094
2095 memcpy(path_words, path_trunc, path_len);
2096
2097 /*
2098 * Pad with '\0' or '>'.
2099 */
2100 if (path_len < (ssize_t)sizeof(path_words)) {
2101 bool complete_str = *(cnp->cn_nameptr + cnp->cn_namelen) == '\0';
2102 memset((char *)path_words + path_len, complete_str ? '\0' : '>',
2103 sizeof(path_words) - path_len);
2104 }
2105 kdebug_vfs_lookup(path_words, (int)path_len, vnp, KDBG_VFS_LOOKUP_FLAG_LOOKUP);
2106 }
2107
2108 #else /* (KDEBUG_LEVEL >= KDEBUG_LEVEL_IST) */
2109
2110 void
2111 kdebug_vfs_lookup(long *dbg_parms __unused, int dbg_namelen __unused,
2112 void *dp __unused, __unused uint32_t flags)
2113 {
2114 }
2115
2116 static void
2117 kdebug_lookup(struct vnode *dp __unused, struct componentname *cnp __unused)
2118 {
2119 }
2120 #endif /* (KDEBUG_LEVEL >= KDEBUG_LEVEL_IST) */
2121
2122 int
2123 vfs_getbyid(fsid_t *fsid, ino64_t ino, vnode_t *vpp, vfs_context_t ctx)
2124 {
2125 mount_t mp;
2126 int error;
2127
2128 mp = mount_lookupby_volfsid(fsid->val[0], 1);
2129 if (mp == NULL) {
2130 return EINVAL;
2131 }
2132
2133 /* Get the target vnode. */
2134 if (ino == 2) {
2135 error = VFS_ROOT(mp, vpp, ctx);
2136 } else {
2137 error = VFS_VGET(mp, ino, vpp, ctx);
2138 }
2139
2140 vfs_unbusy(mp);
2141 return error;
2142 }
2143 /*
2144 * Obtain the real path from a legacy volfs style path.
2145 *
2146 * Valid formats of input path:
2147 *
2148 * "555/@"
2149 * "555/2"
2150 * "555/123456"
2151 * "555/123456/foobar"
2152 *
2153 * Where:
2154 * 555 represents the volfs file system id
2155 * '@' and '2' are aliases to the root of a file system
2156 * 123456 represents a file id
2157 * "foobar" represents a file name
2158 */
2159 #if CONFIG_VOLFS
2160 static int
2161 vfs_getrealpath(const char * path, char * realpath, size_t bufsize, vfs_context_t ctx)
2162 {
2163 vnode_t vp;
2164 struct mount *mp = NULL;
2165 char *str;
2166 char ch;
2167 unsigned long id;
2168 ino64_t ino;
2169 int error;
2170 int length;
2171
2172 /* Get file system id and move str to next component. */
2173 id = strtoul(path, &str, 10);
2174 if (id == 0 || str[0] != '/') {
2175 return EINVAL;
2176 }
2177 while (*str == '/') {
2178 str++;
2179 }
2180 ch = *str;
2181
2182 if (id > INT_MAX) {
2183 return ENOENT;
2184 }
2185 mp = mount_lookupby_volfsid((int)id, 1);
2186 if (mp == NULL) {
2187 return EINVAL; /* unexpected failure */
2188 }
2189 /* Check for an alias to a file system root. */
2190 if (ch == '@' && str[1] == '\0') {
2191 ino = 2;
2192 str++;
2193 } else {
2194 /* Get file id and move str to next component. */
2195 ino = strtouq(str, &str, 10);
2196 }
2197
2198 /* Get the target vnode. */
2199 if (ino == 2) {
2200 struct vfs_attr vfsattr;
2201 int use_vfs_root = TRUE;
2202
2203 VFSATTR_INIT(&vfsattr);
2204 VFSATTR_WANTED(&vfsattr, f_capabilities);
2205 if (vfs_getattr(mp, &vfsattr, vfs_context_kernel()) == 0 &&
2206 VFSATTR_IS_SUPPORTED(&vfsattr, f_capabilities)) {
2207 if ((vfsattr.f_capabilities.capabilities[VOL_CAPABILITIES_FORMAT] & VOL_CAP_FMT_VOL_GROUPS) &&
2208 (vfsattr.f_capabilities.valid[VOL_CAPABILITIES_FORMAT] & VOL_CAP_FMT_VOL_GROUPS)) {
2209 use_vfs_root = FALSE;
2210 }
2211 }
2212
2213 if (use_vfs_root) {
2214 error = VFS_ROOT(mp, &vp, ctx);
2215 } else {
2216 error = VFS_VGET(mp, ino, &vp, ctx);
2217 }
2218 } else {
2219 error = VFS_VGET(mp, ino, &vp, ctx);
2220 }
2221 vfs_unbusy(mp);
2222 if (error) {
2223 goto out;
2224 }
2225 realpath[0] = '\0';
2226
2227 /* Get the absolute path to this vnode. */
2228 error = build_path(vp, realpath, (int)bufsize, &length, 0, ctx);
2229 vnode_put(vp);
2230
2231 if (error == 0 && *str != '\0') {
2232 size_t attempt = strlcat(realpath, str, MAXPATHLEN);
2233 if (attempt > MAXPATHLEN) {
2234 error = ENAMETOOLONG;
2235 }
2236 }
2237 out:
2238 return error;
2239 }
2240 #endif
2241
2242 void
2243 lookup_compound_vnop_post_hook(int error, vnode_t dvp, vnode_t vp, struct nameidata *ndp, int did_create)
2244 {
2245 if (error == 0 && vp == NULLVP) {
2246 panic("NULL vp with error == 0.");
2247 }
2248
2249 /*
2250 * We don't want to do any of this if we didn't use the compound vnop
2251 * to perform the lookup... i.e. if we're allowing and using the legacy pattern,
2252 * where we did a full lookup.
2253 */
2254 if ((ndp->ni_flag & NAMEI_COMPOUND_OP_MASK) == 0) {
2255 return;
2256 }
2257
2258 /*
2259 * If we're going to continue the lookup, we'll handle
2260 * all lookup-related updates at that time.
2261 */
2262 if (error == EKEEPLOOKING) {
2263 return;
2264 }
2265
2266 /*
2267 * Only audit or update cache for *found* vnodes. For creation
2268 * neither would happen in the non-compound-vnop case.
2269 */
2270 if ((vp != NULLVP) && !did_create) {
2271 /*
2272 * If MAKEENTRY isn't set, and we've done a successful compound VNOP,
2273 * then we certainly don't want to update cache or identity.
2274 */
2275 if ((error != 0) || (ndp->ni_cnd.cn_flags & MAKEENTRY)) {
2276 lookup_consider_update_cache(dvp, vp, &ndp->ni_cnd, ndp->ni_ncgeneration);
2277 }
2278 if (ndp->ni_cnd.cn_flags & AUDITVNPATH1) {
2279 AUDIT_ARG(vnpath, vp, ARG_VNODE1);
2280 } else if (ndp->ni_cnd.cn_flags & AUDITVNPATH2) {
2281 AUDIT_ARG(vnpath, vp, ARG_VNODE2);
2282 }
2283 }
2284
2285 /*
2286 * If you created (whether you opened or not), cut a lookup tracepoint
2287 * for the parent dir (as would happen without a compound vnop). Note: we may need
2288 * a vnode despite failure in this case!
2289 *
2290 * If you did not create:
2291 * Found child (succeeded or not): cut a tracepoint for the child.
2292 * Did not find child: cut a tracepoint with the parent.
2293 */
2294 if (kdebug_enable) {
2295 kdebug_lookup(vp ? vp : dvp, &ndp->ni_cnd);
2296 }
2297 }
2298