1 /*
2 * Copyright (c) 2000-2020 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /* Copyright (c) 1995 NeXT Computer, Inc. All Rights Reserved */
29 /*
30 * Copyright (c) 1982, 1986, 1989, 1993
31 * The Regents of the University of California. All rights reserved.
32 * (c) UNIX System Laboratories, Inc.
33 * All or some portions of this file are derived from material licensed
34 * to the University of California by American Telephone and Telegraph
35 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
36 * the permission of UNIX System Laboratories, Inc.
37 *
38 * Redistribution and use in source and binary forms, with or without
39 * modification, are permitted provided that the following conditions
40 * are met:
41 * 1. Redistributions of source code must retain the above copyright
42 * notice, this list of conditions and the following disclaimer.
43 * 2. Redistributions in binary form must reproduce the above copyright
44 * notice, this list of conditions and the following disclaimer in the
45 * documentation and/or other materials provided with the distribution.
46 * 3. All advertising materials mentioning features or use of this software
47 * must display the following acknowledgement:
48 * This product includes software developed by the University of
49 * California, Berkeley and its contributors.
50 * 4. Neither the name of the University nor the names of its contributors
51 * may be used to endorse or promote products derived from this software
52 * without specific prior written permission.
53 *
54 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
55 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
56 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
57 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
58 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
59 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
60 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
61 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
62 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
63 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
64 * SUCH DAMAGE.
65 *
66 * @(#)vfs_vnops.c 8.14 (Berkeley) 6/15/95
67 *
68 */
69 /*
70 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
71 * support for mandatory and extensible security protections. This notice
72 * is included in support of clause 2.2 (b) of the Apple Public License,
73 * Version 2.0.
74 */
75
76 #include <sys/param.h>
77 #include <sys/types.h>
78 #include <sys/systm.h>
79 #include <sys/kernel.h>
80 #include <sys/file_internal.h>
81 #include <sys/stat.h>
82 #include <sys/proc_internal.h>
83 #include <sys/kauth.h>
84 #include <sys/mount_internal.h>
85 #include <sys/namei.h>
86 #include <sys/vnode_internal.h>
87 #include <sys/ioctl.h>
88 #include <sys/fsctl.h>
89 #include <sys/tty.h>
90 #include <sys/ubc.h>
91 #include <sys/conf.h>
92 #include <sys/disk.h>
93 #include <sys/fsevents.h>
94 #include <sys/kdebug.h>
95 #include <sys/xattr.h>
96 #include <sys/ubc_internal.h>
97 #include <sys/uio_internal.h>
98 #include <sys/resourcevar.h>
99 #include <sys/signalvar.h>
100
101 #include <vm/vm_kern.h>
102 #include <vm/vm_map.h>
103
104 #include <miscfs/specfs/specdev.h>
105 #include <miscfs/fifofs/fifo.h>
106
107 #if CONFIG_MACF
108 #include <security/mac_framework.h>
109 #endif
110
111 #include <IOKit/IOBSD.h>
112 #include <libkern/section_keywords.h>
113
114 static int vn_closefile(struct fileglob *fp, vfs_context_t ctx);
115 static int vn_ioctl(struct fileproc *fp, u_long com, caddr_t data,
116 vfs_context_t ctx);
117 static int vn_read(struct fileproc *fp, struct uio *uio, int flags,
118 vfs_context_t ctx);
119 static int vn_write(struct fileproc *fp, struct uio *uio, int flags,
120 vfs_context_t ctx);
121 static int vn_select( struct fileproc *fp, int which, void * wql,
122 vfs_context_t ctx);
123 static int vn_kqfilter(struct fileproc *fp, struct knote *kn,
124 struct kevent_qos_s *kev);
125 static void filt_vndetach(struct knote *kn);
126 static int filt_vnode(struct knote *kn, long hint);
127 static int filt_vnode_common(struct knote *kn, struct kevent_qos_s *kev,
128 vnode_t vp, long hint);
129 static int vn_open_auth_finish(vnode_t vp, int fmode, vfs_context_t ctx);
130
131 const struct fileops vnops = {
132 .fo_type = DTYPE_VNODE,
133 .fo_read = vn_read,
134 .fo_write = vn_write,
135 .fo_ioctl = vn_ioctl,
136 .fo_select = vn_select,
137 .fo_close = vn_closefile,
138 .fo_drain = fo_no_drain,
139 .fo_kqfilter = vn_kqfilter,
140 };
141
142 static int filt_vntouch(struct knote *kn, struct kevent_qos_s *kev);
143 static int filt_vnprocess(struct knote *kn, struct kevent_qos_s*kev);
144
145 SECURITY_READ_ONLY_EARLY(struct filterops) vnode_filtops = {
146 .f_isfd = 1,
147 .f_attach = NULL,
148 .f_detach = filt_vndetach,
149 .f_event = filt_vnode,
150 .f_touch = filt_vntouch,
151 .f_process = filt_vnprocess,
152 };
153
154 /*
155 * Common code for vnode open operations.
156 * Check permissions, and call the VNOP_OPEN or VNOP_CREATE routine.
157 *
158 * XXX the profusion of interfaces here is probably a bad thing.
159 */
160 int
vn_open(struct nameidata * ndp,int fmode,int cmode)161 vn_open(struct nameidata *ndp, int fmode, int cmode)
162 {
163 return vn_open_modflags(ndp, &fmode, cmode);
164 }
165
166 int
vn_open_modflags(struct nameidata * ndp,int * fmodep,int cmode)167 vn_open_modflags(struct nameidata *ndp, int *fmodep, int cmode)
168 {
169 int error;
170 struct vnode_attr *vap;
171
172 vap = kalloc_type(struct vnode_attr, Z_WAITOK);
173
174 VATTR_INIT(vap);
175 VATTR_SET(vap, va_mode, (mode_t)cmode);
176
177 error = vn_open_auth(ndp, fmodep, vap, NULLVP);
178
179 kfree_type(struct vnode_attr, vap);
180
181 return error;
182 }
183
184 static int
vn_open_auth_finish(vnode_t vp,int fmode,vfs_context_t ctx)185 vn_open_auth_finish(vnode_t vp, int fmode, vfs_context_t ctx)
186 {
187 int error;
188
189 if ((error = vnode_ref_ext(vp, fmode, 0)) != 0) {
190 goto bad;
191 }
192
193 /* Call out to allow 3rd party notification of open.
194 * Ignore result of kauth_authorize_fileop call.
195 */
196 #if CONFIG_MACF
197 mac_vnode_notify_open(ctx, vp, fmode);
198 #endif
199 kauth_authorize_fileop(vfs_context_ucred(ctx), KAUTH_FILEOP_OPEN,
200 (uintptr_t)vp, 0);
201
202 return 0;
203
204 bad:
205 return error;
206 }
207
208 /*
209 * May do nameidone() to allow safely adding an FSEvent. Cue off of ni_dvp to
210 * determine whether that has happened.
211 */
212 static int
vn_open_auth_do_create(struct nameidata * ndp,struct vnode_attr * vap,int fmode,boolean_t * did_create,boolean_t * did_open,vfs_context_t ctx)213 vn_open_auth_do_create(struct nameidata *ndp, struct vnode_attr *vap, int fmode, boolean_t *did_create, boolean_t *did_open, vfs_context_t ctx)
214 {
215 uint32_t status = 0;
216 vnode_t dvp = ndp->ni_dvp;
217 int batched;
218 int error;
219 vnode_t vp;
220
221 batched = vnode_compound_open_available(ndp->ni_dvp);
222 *did_open = FALSE;
223
224 VATTR_SET(vap, va_type, VREG);
225 if (fmode & O_EXCL) {
226 vap->va_vaflags |= VA_EXCLUSIVE;
227 }
228
229 #if NAMEDRSRCFORK
230 if (ndp->ni_cnd.cn_flags & CN_WANTSRSRCFORK) {
231 if ((error = vn_authorize_create(dvp, &ndp->ni_cnd, vap, ctx, NULL)) != 0) {
232 goto out;
233 }
234 if ((error = vnode_makenamedstream(dvp, &ndp->ni_vp, XATTR_RESOURCEFORK_NAME, 0, ctx)) != 0) {
235 goto out;
236 }
237 *did_create = TRUE;
238 } else {
239 #endif
240 if (!batched) {
241 if ((error = vn_authorize_create(dvp, &ndp->ni_cnd, vap, ctx, NULL)) != 0) {
242 goto out;
243 }
244 }
245
246 error = vn_create(dvp, &ndp->ni_vp, ndp, vap, VN_CREATE_DOOPEN, fmode, &status, ctx);
247 if (error != 0) {
248 if (batched) {
249 *did_create = (status & COMPOUND_OPEN_STATUS_DID_CREATE) ? TRUE : FALSE;
250 } else {
251 *did_create = FALSE;
252 }
253
254 if (error == EKEEPLOOKING) {
255 if (*did_create) {
256 panic("EKEEPLOOKING, but we did a create?");
257 }
258 if (!batched) {
259 panic("EKEEPLOOKING from filesystem that doesn't support compound vnops?");
260 }
261 if ((ndp->ni_flag & NAMEI_CONTLOOKUP) == 0) {
262 panic("EKEEPLOOKING, but continue flag not set?");
263 }
264
265 /*
266 * Do NOT drop the dvp: we need everything to continue the lookup.
267 */
268 return error;
269 }
270 } else {
271 if (batched) {
272 *did_create = (status & COMPOUND_OPEN_STATUS_DID_CREATE) ? 1 : 0;
273 *did_open = TRUE;
274 } else {
275 *did_create = TRUE;
276 }
277 }
278 #if NAMEDRSRCFORK
279 }
280 #endif
281
282 vp = ndp->ni_vp;
283
284 if (*did_create) {
285 int update_flags = 0;
286
287 // Make sure the name & parent pointers are hooked up
288 if (vp->v_name == NULL) {
289 update_flags |= VNODE_UPDATE_NAME;
290 }
291 if (vp->v_parent == NULLVP) {
292 update_flags |= VNODE_UPDATE_PARENT;
293 }
294
295 if (update_flags) {
296 vnode_update_identity(vp, dvp, ndp->ni_cnd.cn_nameptr, ndp->ni_cnd.cn_namelen, ndp->ni_cnd.cn_hash, update_flags);
297 }
298
299 vnode_put(dvp);
300 ndp->ni_dvp = NULLVP;
301
302 #if CONFIG_FSE
303 if (need_fsevent(FSE_CREATE_FILE, vp)) {
304 add_fsevent(FSE_CREATE_FILE, ctx,
305 FSE_ARG_VNODE, vp,
306 FSE_ARG_DONE);
307 }
308 #endif
309 }
310 out:
311 if (ndp->ni_dvp != NULLVP) {
312 vnode_put(dvp);
313 ndp->ni_dvp = NULLVP;
314 }
315
316 return error;
317 }
318
319 /*
320 * This is the number of times we'll loop in vn_open_auth without explicitly
321 * yielding the CPU when we determine we have to retry.
322 */
323 #define RETRY_NO_YIELD_COUNT 5
324
325 /*
326 * Open a file with authorization, updating the contents of the structures
327 * pointed to by ndp, fmodep, and vap as necessary to perform the requested
328 * operation. This function is used for both opens of existing files, and
329 * creation of new files.
330 *
331 * Parameters: ndp The nami data pointer describing the
332 * file
333 * fmodep A pointer to an int containg the mode
334 * information to be used for the open
335 * vap A pointer to the vnode attribute
336 * descriptor to be used for the open
337 * authvp If non-null and VA_DP_AUTHENTICATE is set in vap,
338 * have a supporting filesystem verify that the file
339 * to be opened is on the same volume as authvp and
340 * that authvp is on an authenticated volume
341 *
342 * Indirect: * Contents of the data structures pointed
343 * to by the parameters are modified as
344 * necessary to the requested operation.
345 *
346 * Returns: 0 Success
347 * !0 errno value
348 *
349 * Notes: The kauth_filesec_t in 'vap', if any, is in host byte order.
350 *
351 * The contents of '*ndp' will be modified, based on the other
352 * arguments to this function, and to return file and directory
353 * data necessary to satisfy the requested operation.
354 *
355 * If the file does not exist and we are creating it, then the
356 * O_TRUNC flag will be cleared in '*fmodep' to indicate to the
357 * caller that the file was not truncated.
358 *
359 * If the file exists and the O_EXCL flag was not specified, then
360 * the O_CREAT flag will be cleared in '*fmodep' to indicate to
361 * the caller that the existing file was merely opened rather
362 * than created.
363 *
364 * The contents of '*vap' will be modified as necessary to
365 * complete the operation, including setting of supported
366 * attribute, clearing of fields containing unsupported attributes
367 * in the request, if the request proceeds without them, etc..
368 *
369 * XXX: This function is too complicated in actings on its arguments
370 *
371 * XXX: We should enummerate the possible errno values here, and where
372 * in the code they originated.
373 */
374 int
vn_open_auth(struct nameidata * ndp,int * fmodep,struct vnode_attr * vap,vnode_t authvp)375 vn_open_auth(struct nameidata *ndp, int *fmodep, struct vnode_attr *vap, vnode_t authvp)
376 {
377 struct vnode *vp;
378 struct vnode *dvp;
379 vfs_context_t ctx = ndp->ni_cnd.cn_context;
380 int error;
381 int fmode;
382 uint32_t origcnflags;
383 boolean_t did_create;
384 boolean_t did_open;
385 boolean_t need_vnop_open;
386 boolean_t batched;
387 boolean_t ref_failed;
388 int nretries = 0, max_retries = 10;
389
390 again:
391 vp = NULL;
392 dvp = NULL;
393 batched = FALSE;
394 did_create = FALSE;
395 need_vnop_open = TRUE;
396 ref_failed = FALSE;
397 fmode = *fmodep;
398 origcnflags = ndp->ni_cnd.cn_flags;
399
400 if (VATTR_IS_ACTIVE(vap, va_dataprotect_flags)) {
401 if ((authvp != NULLVP)
402 && !ISSET(vap->va_dataprotect_flags, VA_DP_AUTHENTICATE)) {
403 error = EINVAL;
404 goto out;
405 }
406 // If raw encrypted mode is requested, handle that here
407 if (ISSET(vap->va_dataprotect_flags, VA_DP_RAWENCRYPTED)) {
408 fmode |= FENCRYPTED;
409 }
410 }
411
412 if ((fmode & O_NOFOLLOW_ANY) && (fmode & O_NOFOLLOW)) {
413 error = EINVAL;
414 goto out;
415 }
416
417 /*
418 * We only call nameidone when exiting the function because we may
419 * end up needing the pathname buffer in the component structure.
420 */
421
422 /*
423 * O_CREAT
424 */
425 if (fmode & O_CREAT) {
426 if ((fmode & O_DIRECTORY)) {
427 error = EINVAL;
428 goto out;
429 }
430 ndp->ni_cnd.cn_nameiop = CREATE;
431 #if CONFIG_TRIGGERS
432 ndp->ni_op = OP_LINK;
433 #endif
434 /* Inherit USEDVP, vnode_open() supported flags only */
435 ndp->ni_cnd.cn_flags &= (USEDVP | NOCROSSMOUNT);
436 ndp->ni_cnd.cn_flags |= LOCKPARENT | LOCKLEAF | AUDITVNPATH1;
437 /* Inherit NAMEI_ROOTDIR flag only */
438 ndp->ni_flag &= NAMEI_ROOTDIR;
439 ndp->ni_flag |= NAMEI_COMPOUNDOPEN;
440 #if NAMEDRSRCFORK
441 /* open calls are allowed for resource forks. */
442 ndp->ni_cnd.cn_flags |= CN_ALLOWRSRCFORK;
443 #endif
444 if ((fmode & O_EXCL) == 0 && (fmode & O_NOFOLLOW) == 0 && (origcnflags & FOLLOW) != 0 && (fmode & O_SYMLINK) == 0) {
445 ndp->ni_cnd.cn_flags |= FOLLOW;
446 }
447 if (fmode & O_NOFOLLOW_ANY) {
448 /* will return ELOOP on the first symlink to be hit */
449 ndp->ni_flag |= NAMEI_NOFOLLOW_ANY;
450 }
451 if (fmode & O_RESOLVE_BENEATH) {
452 /* will return ENOTCAPABLE if path resolution escapes the starting directory */
453 ndp->ni_flag |= NAMEI_RESOLVE_BENEATH;
454 }
455 if (fmode & O_UNIQUE) {
456 /* will return ENOTCAPABLE if target vnode has multiple links */
457 ndp->ni_flag |= NAMEI_UNIQUE;
458 }
459
460 continue_create_lookup:
461 if ((error = namei(ndp))) {
462 goto out;
463 }
464
465 dvp = ndp->ni_dvp;
466 vp = ndp->ni_vp;
467
468 batched = vnode_compound_open_available(dvp);
469
470 /* not found, create */
471 if (vp == NULL) {
472 /* must have attributes for a new file */
473 if (vap == NULL) {
474 vnode_put(dvp);
475 error = EINVAL;
476 goto out;
477 }
478 /*
479 * Attempt a create. For a system supporting compound VNOPs, we may
480 * find an existing file or create one; in either case, we will already
481 * have the file open and no VNOP_OPEN() will be needed.
482 */
483 error = vn_open_auth_do_create(ndp, vap, fmode, &did_create, &did_open, ctx);
484
485 dvp = ndp->ni_dvp;
486 vp = ndp->ni_vp;
487
488 /* Detected a node that the filesystem couldn't handle */
489 if (error == EKEEPLOOKING) {
490 if (!batched) {
491 panic("EKEEPLOOKING from a filesystem that doesn't support compound VNOPs?");
492 }
493 goto continue_create_lookup;
494 }
495
496 if (dvp) {
497 panic("Shouldn't have a dvp here.");
498 }
499
500 if (error) {
501 /*
502 * Check for a create race.
503 */
504 if ((error == EEXIST) && !(fmode & O_EXCL)) {
505 if (vp) {
506 vnode_put(vp);
507 }
508 nameidone(ndp);
509 goto again;
510 }
511 goto bad;
512 }
513
514 need_vnop_open = !did_open;
515 } else {
516 if (fmode & O_EXCL) {
517 error = EEXIST;
518 }
519
520 /*
521 * We have a vnode. Use compound open if available
522 * or else fall through to "traditional" path. Note: can't
523 * do a compound open for root, because the parent belongs
524 * to a different FS.
525 */
526 if (error == 0 && batched && (vnode_mount(dvp) == vnode_mount(vp))) {
527 error = VNOP_COMPOUND_OPEN(dvp, &ndp->ni_vp, ndp, 0, fmode, NULL, NULL, ctx);
528
529 if (error == 0) {
530 vp = ndp->ni_vp;
531 need_vnop_open = FALSE;
532 } else if (error == EKEEPLOOKING) {
533 if ((ndp->ni_flag & NAMEI_CONTLOOKUP) == 0) {
534 panic("EKEEPLOOKING, but continue flag not set?");
535 }
536 goto continue_create_lookup;
537 }
538 }
539 vnode_put(dvp);
540 ndp->ni_dvp = NULLVP;
541
542 if (error) {
543 goto bad;
544 }
545
546 fmode &= ~O_CREAT;
547
548 /* Fall through */
549 }
550 } else {
551 /*
552 * Not O_CREAT
553 */
554 ndp->ni_cnd.cn_nameiop = LOOKUP;
555 /* Inherit USEDVP, vnode_open() supported flags only */
556 ndp->ni_cnd.cn_flags &= (USEDVP | NOCROSSMOUNT);
557 ndp->ni_cnd.cn_flags |= FOLLOW | LOCKLEAF | AUDITVNPATH1 | WANTPARENT;
558 #if NAMEDRSRCFORK
559 /* open calls are allowed for resource forks. */
560 ndp->ni_cnd.cn_flags |= CN_ALLOWRSRCFORK;
561 #endif
562 if (fmode & FENCRYPTED) {
563 ndp->ni_cnd.cn_flags |= CN_RAW_ENCRYPTED | CN_SKIPNAMECACHE;
564 }
565 /* Inherit NAMEI_ROOTDIR flag only */
566 ndp->ni_flag &= NAMEI_ROOTDIR;
567 ndp->ni_flag |= NAMEI_COMPOUNDOPEN;
568
569 /* preserve NOFOLLOW from vnode_open() */
570 if (fmode & O_NOFOLLOW || fmode & O_SYMLINK || (origcnflags & FOLLOW) == 0) {
571 ndp->ni_cnd.cn_flags &= ~FOLLOW;
572 }
573 if (fmode & O_NOFOLLOW_ANY) {
574 /* will return ELOOP on the first symlink to be hit */
575 ndp->ni_flag |= NAMEI_NOFOLLOW_ANY;
576 }
577 if (fmode & O_RESOLVE_BENEATH) {
578 /* will return ENOTCAPABLE if path resolution escapes the starting directory */
579 ndp->ni_flag |= NAMEI_RESOLVE_BENEATH;
580 }
581 if (fmode & O_UNIQUE) {
582 /* will return ENOTCAPABLE if target vnode has multiple links */
583 ndp->ni_flag |= NAMEI_UNIQUE;
584 }
585
586 /* Do a lookup, possibly going directly to filesystem for compound operation */
587 do {
588 if ((error = namei(ndp))) {
589 goto out;
590 }
591 vp = ndp->ni_vp;
592 dvp = ndp->ni_dvp;
593
594 /* Check for batched lookup-open */
595 batched = vnode_compound_open_available(dvp);
596 if (batched && ((vp == NULLVP) || (vnode_mount(dvp) == vnode_mount(vp)))) {
597 error = VNOP_COMPOUND_OPEN(dvp, &ndp->ni_vp, ndp, 0, fmode, NULL, NULL, ctx);
598 vp = ndp->ni_vp;
599 if (error == 0) {
600 need_vnop_open = FALSE;
601 } else if (error == EKEEPLOOKING) {
602 if ((ndp->ni_flag & NAMEI_CONTLOOKUP) == 0) {
603 panic("EKEEPLOOKING, but continue flag not set?");
604 }
605 } else if ((fmode & (FREAD | FWRITE | FEXEC)) == FEXEC) {
606 /*
607 * Some file systems fail in vnop_open call with absense of
608 * both FREAD and FWRITE access modes. Retry the vnop_open
609 * call again with FREAD access mode added.
610 */
611 error = VNOP_COMPOUND_OPEN(dvp, &ndp->ni_vp, ndp, 0,
612 fmode | FREAD, NULL, NULL, ctx);
613 if (error == 0) {
614 vp = ndp->ni_vp;
615 need_vnop_open = FALSE;
616 }
617 }
618 }
619 } while (error == EKEEPLOOKING);
620
621 vnode_put(dvp);
622 ndp->ni_dvp = NULLVP;
623
624 if (error) {
625 goto bad;
626 }
627 }
628
629 /*
630 * By this point, dvp iocount is dropped and dvp pointer is cleared.
631 */
632 if (ndp->ni_dvp != NULLVP) {
633 panic("Haven't cleaned up adequately in vn_open_auth()");
634 }
635
636 /* Verify that the vnode returned from namei() has the expected fileid and fsid */
637 if (VATTR_IS_ACTIVE(vap, va_flags) && ISSET(vap->va_flags, VA_VAFILEID)) {
638 vnode_t tmp_vp;
639
640 if (!VATTR_IS_ACTIVE(vap, va_fsid64) || !VATTR_IS_ACTIVE(vap, va_fileid)) {
641 error = EINVAL;
642 goto bad;
643 }
644
645 error = vnode_getfromid(vap->va_fsid64.val[0], vap->va_fileid, ctx, FSOPT_ISREALFSID, &tmp_vp);
646 if (error) {
647 goto bad;
648 }
649
650 if (tmp_vp != vp) {
651 vnode_put(tmp_vp);
652 error = ERECYCLE;
653 goto bad;
654 }
655 vnode_put(tmp_vp);
656 }
657
658 /*
659 * Expect to use this code for filesystems without compound VNOPs, for the root
660 * of a filesystem, which can't be "looked up" in the sense of VNOP_LOOKUP(),
661 * and for shadow files, which do not live on the same filesystems as their "parents."
662 */
663 if (need_vnop_open) {
664 if (batched && !vnode_isvroot(vp) && !vnode_isnamedstream(vp)) {
665 panic("Why am I trying to use VNOP_OPEN() on anything other than the root or a named stream?");
666 }
667
668 if (!did_create) {
669 error = vn_authorize_open_existing(vp, &ndp->ni_cnd, fmode, ctx, NULL);
670 if (error) {
671 goto bad;
672 }
673 }
674
675 if (VATTR_IS_ACTIVE(vap, va_dataprotect_flags)) {
676 if (ISSET(vap->va_dataprotect_flags, VA_DP_RAWUNENCRYPTED)) {
677 /* Don't allow unencrypted io request from user space unless entitled */
678 boolean_t entitled = FALSE;
679 #if !SECURE_KERNEL
680 entitled = IOCurrentTaskHasEntitlement("com.apple.private.security.file-unencrypt-access");
681 #endif /* SECURE_KERNEL */
682 if (!entitled) {
683 error = EPERM;
684 goto bad;
685 }
686 fmode |= FUNENCRYPTED;
687 }
688
689 if (ISSET(vap->va_dataprotect_flags, VA_DP_AUTHENTICATE)) {
690 fsioc_auth_fs_t afs = { .authvp = authvp };
691
692 error = VNOP_IOCTL(vp, FSIOC_AUTH_FS, (caddr_t)&afs, 0, ctx);
693 if (error) {
694 goto bad;
695 }
696 }
697 }
698
699 error = VNOP_OPEN(vp, fmode, ctx);
700 if (error) {
701 /*
702 * Some file systems fail in vnop_open call with absense of both
703 * FREAD and FWRITE access modes. Retry the vnop_open call again
704 * with FREAD access mode added.
705 */
706 if ((fmode & (FREAD | FWRITE | FEXEC)) == FEXEC) {
707 error = VNOP_OPEN(vp, fmode | FREAD, ctx);
708 }
709 if (error) {
710 goto bad;
711 }
712 }
713 need_vnop_open = FALSE;
714 }
715
716 // if the vnode is tagged VOPENEVT and the current process
717 // has the P_CHECKOPENEVT flag set, then we or in the O_EVTONLY
718 // flag to the open mode so that this open won't count against
719 // the vnode when carbon delete() does a vnode_isinuse() to see
720 // if a file is currently in use. this allows spotlight
721 // importers to not interfere with carbon apps that depend on
722 // the no-delete-if-busy semantics of carbon delete().
723 //
724 if (!did_create && (vp->v_flag & VOPENEVT) && (current_proc()->p_flag & P_CHECKOPENEVT)) {
725 fmode |= O_EVTONLY;
726 }
727
728 /*
729 * Grab reference, etc.
730 */
731 error = vn_open_auth_finish(vp, fmode, ctx);
732 if (error) {
733 ref_failed = TRUE;
734 goto bad;
735 }
736
737 /* Compound VNOP open is responsible for doing the truncate */
738 if (batched || did_create) {
739 fmode &= ~O_TRUNC;
740 }
741
742 *fmodep = fmode;
743 nameidone(ndp);
744 return 0;
745
746 bad:
747 /* Opened either explicitly or by a batched create */
748 if (!need_vnop_open) {
749 VNOP_CLOSE(vp, fmode, ctx);
750 }
751
752 ndp->ni_vp = NULL;
753 if (vp) {
754 #if NAMEDRSRCFORK
755 /* Aggressively recycle shadow files if we error'd out during open() */
756 if ((vnode_isnamedstream(vp)) &&
757 (vp->v_parent != NULLVP) &&
758 (vnode_isshadow(vp))) {
759 vnode_recycle(vp);
760 }
761 #endif
762 vnode_put(vp);
763 /*
764 * Check for a race against unlink. We had a vnode
765 * but according to vnode_authorize or VNOP_OPEN it
766 * no longer exists.
767 *
768 * EREDRIVEOPEN: means that we were hit by the tty allocation race or NFSv4 open/create race.
769 */
770 if (((error == ENOENT) && (*fmodep & O_CREAT)) || (error == EREDRIVEOPEN) || ref_failed) {
771 /*
772 * We'll retry here but it may be possible that we get
773 * into a retry "spin" inside the kernel and not allow
774 * threads, which need to run in order for the retry
775 * loop to end, to run. An example is an open of a
776 * terminal which is getting revoked and we spin here
777 * without yielding becasue namei and VNOP_OPEN are
778 * successful but vnode_ref fails. The revoke needs
779 * threads with an iocount to run but if spin here we
780 * may possibly be blcoking other threads from running.
781 *
782 * We start yielding the CPU after some number of
783 * retries for increasing durations.
784 */
785 nretries += 1;
786 if (nretries > max_retries) {
787 printf("%s: reached max_retries error %d need_vnop_open %d "
788 "fmode 0x%x ref_failed %d\n",
789 __func__, error, need_vnop_open, *fmodep, ref_failed);
790 goto out;
791 }
792 if (nretries > RETRY_NO_YIELD_COUNT) {
793 struct timespec to;
794
795 to.tv_sec = 0;
796 to.tv_nsec = nretries * 10 * NSEC_PER_MSEC;
797 msleep(&nretries, (lck_mtx_t *)0, PVFS, "vn_open_auth_retry", &to);
798 }
799 nameidone(ndp);
800 goto again;
801 }
802 }
803
804 out:
805 nameidone(ndp);
806 return error;
807 }
808
809 #if vn_access_DEPRECATED
810 /*
811 * Authorize an action against a vnode. This has been the canonical way to
812 * ensure that the credential/process/etc. referenced by a vfs_context
813 * is granted the rights called out in 'mode' against the vnode 'vp'.
814 *
815 * Unfortunately, the use of VREAD/VWRITE/VEXEC makes it very difficult
816 * to add support for more rights. As such, this interface will be deprecated
817 * and callers will use vnode_authorize instead.
818 */
819 int
vn_access(vnode_t vp,int mode,vfs_context_t context)820 vn_access(vnode_t vp, int mode, vfs_context_t context)
821 {
822 kauth_action_t action;
823
824 action = 0;
825 if (mode & VREAD) {
826 action |= KAUTH_VNODE_READ_DATA;
827 }
828 if (mode & VWRITE) {
829 action |= KAUTH_VNODE_WRITE_DATA;
830 }
831 if (mode & VEXEC) {
832 action |= KAUTH_VNODE_EXECUTE;
833 }
834
835 return vnode_authorize(vp, NULL, action, context);
836 }
837 #endif /* vn_access_DEPRECATED */
838
839 /*
840 * Vnode close call
841 */
842 int
vn_close(struct vnode * vp,int flags,vfs_context_t ctx)843 vn_close(struct vnode *vp, int flags, vfs_context_t ctx)
844 {
845 int error;
846 int flusherror = 0;
847
848 #if NAMEDRSRCFORK
849 /* Sync data from resource fork shadow file if needed. */
850 if ((vp->v_flag & VISNAMEDSTREAM) &&
851 (vp->v_parent != NULLVP) &&
852 vnode_isshadow(vp)) {
853 if (flags & FWASWRITTEN) {
854 flusherror = vnode_flushnamedstream(vp->v_parent, vp, ctx);
855 }
856 }
857 #endif
858 /*
859 * If vnode @vp belongs to a chardev or a blkdev then it is handled
860 * specially. We first drop its user reference count @vp->v_usecount
861 * before calling VNOP_CLOSE(). This was done historically to ensure
862 * that the last close of a special device vnode performed some
863 * conditional cleanups. Now we still need to drop this reference here
864 * to ensure that devfsspec_close() can check if the vnode is still in
865 * use.
866 */
867 if (vnode_isspec(vp)) {
868 (void)vnode_rele_ext(vp, flags, 0);
869 }
870
871 /*
872 * On HFS, we flush when the last writer closes. We do this
873 * because resource fork vnodes hold a reference on data fork
874 * vnodes and that will prevent them from getting VNOP_INACTIVE
875 * which will delay when we flush cached data. In future, we
876 * might find it beneficial to do this for all file systems.
877 * Note that it's OK to access v_writecount without the lock
878 * in this context.
879 */
880 if (vp->v_tag == VT_HFS && (flags & FWRITE) && vp->v_writecount == 1) {
881 VNOP_FSYNC(vp, MNT_NOWAIT, ctx);
882 }
883
884 error = VNOP_CLOSE(vp, flags, ctx);
885
886 #if CONFIG_FSE
887 if (flags & FWASWRITTEN) {
888 if (need_fsevent(FSE_CONTENT_MODIFIED, vp)) {
889 add_fsevent(FSE_CONTENT_MODIFIED, ctx,
890 FSE_ARG_VNODE, vp,
891 FSE_ARG_DONE);
892 }
893 }
894 #endif
895
896 if (!vnode_isspec(vp)) {
897 (void)vnode_rele_ext(vp, flags, 0);
898 }
899
900 if (flusherror) {
901 error = flusherror;
902 }
903 return error;
904 }
905
906 static int
vn_read_swapfile(struct vnode * vp,uio_t uio)907 vn_read_swapfile(
908 struct vnode *vp,
909 uio_t uio)
910 {
911 int error;
912 off_t swap_count, this_count;
913 off_t file_end, read_end;
914 off_t prev_resid;
915 char *my_swap_page;
916
917 /*
918 * Reading from a swap file will get you zeroes.
919 */
920
921 my_swap_page = NULL;
922 error = 0;
923 swap_count = uio_resid(uio);
924
925 file_end = ubc_getsize(vp);
926 read_end = uio->uio_offset + uio_resid(uio);
927 if (uio->uio_offset >= file_end) {
928 /* uio starts after end of file: nothing to read */
929 swap_count = 0;
930 } else if (read_end > file_end) {
931 /* uio extends beyond end of file: stop before that */
932 swap_count -= (read_end - file_end);
933 }
934
935 while (swap_count > 0) {
936 if (my_swap_page == NULL) {
937 my_swap_page = kalloc_data(PAGE_SIZE, Z_WAITOK | Z_ZERO);
938 /* add an end-of-line to keep line counters happy */
939 my_swap_page[PAGE_SIZE - 1] = '\n';
940 }
941 this_count = swap_count;
942 if (this_count > PAGE_SIZE) {
943 this_count = PAGE_SIZE;
944 }
945
946 prev_resid = uio_resid(uio);
947 error = uiomove((caddr_t) my_swap_page,
948 (int)this_count,
949 uio);
950 if (error) {
951 break;
952 }
953 swap_count -= (prev_resid - uio_resid(uio));
954 }
955 kfree_data(my_swap_page, PAGE_SIZE);
956
957 return error;
958 }
959 /*
960 * Package up an I/O request on a vnode into a uio and do it.
961 */
962 int
vn_rdwr(enum uio_rw rw,struct vnode * vp,caddr_t base,int len,off_t offset,enum uio_seg segflg,int ioflg,kauth_cred_t cred,int * aresid,proc_t p)963 vn_rdwr(
964 enum uio_rw rw,
965 struct vnode *vp,
966 caddr_t base,
967 int len,
968 off_t offset,
969 enum uio_seg segflg,
970 int ioflg,
971 kauth_cred_t cred,
972 int *aresid,
973 proc_t p)
974 {
975 int64_t resid;
976 int result;
977
978 if (len < 0) {
979 return EINVAL;
980 }
981
982 result = vn_rdwr_64(rw,
983 vp,
984 (uint64_t)(uintptr_t)base,
985 (int64_t)len,
986 offset,
987 segflg,
988 ioflg,
989 cred,
990 &resid,
991 p);
992
993 /* "resid" should be bounded above by "len," which is an int */
994 if (aresid != NULL) {
995 *aresid = (int)resid;
996 }
997
998 return result;
999 }
1000
1001
1002 int
vn_rdwr_64(enum uio_rw rw,struct vnode * vp,uint64_t base,int64_t len,off_t offset,enum uio_seg segflg,int ioflg,kauth_cred_t cred,int64_t * aresid,proc_t p)1003 vn_rdwr_64(
1004 enum uio_rw rw,
1005 struct vnode *vp,
1006 uint64_t base,
1007 int64_t len,
1008 off_t offset,
1009 enum uio_seg segflg,
1010 int ioflg,
1011 kauth_cred_t cred,
1012 int64_t *aresid,
1013 proc_t p)
1014 {
1015 uio_t auio;
1016 int spacetype;
1017 struct vfs_context context;
1018 int error = 0;
1019 UIO_STACKBUF(uio_buf, 1);
1020
1021 context.vc_thread = current_thread();
1022 context.vc_ucred = cred;
1023
1024 if (UIO_SEG_IS_USER_SPACE(segflg)) {
1025 spacetype = proc_is64bit(p) ? UIO_USERSPACE64 : UIO_USERSPACE32;
1026 } else {
1027 spacetype = UIO_SYSSPACE;
1028 }
1029
1030 if (len < 0) {
1031 return EINVAL;
1032 }
1033
1034 auio = uio_createwithbuffer(1, offset, spacetype, rw,
1035 &uio_buf[0], sizeof(uio_buf));
1036 uio_addiov(auio, CAST_USER_ADDR_T(base), (user_size_t)len);
1037
1038 #if CONFIG_MACF
1039 /* XXXMAC
1040 * IO_NOAUTH should be re-examined.
1041 * Likely that mediation should be performed in caller.
1042 */
1043 if ((ioflg & IO_NOAUTH) == 0) {
1044 /* passed cred is fp->f_cred */
1045 if (rw == UIO_READ) {
1046 error = mac_vnode_check_read(&context, cred, vp);
1047 } else {
1048 error = mac_vnode_check_write(&context, cred, vp);
1049 }
1050 }
1051 #endif
1052
1053 if (error == 0) {
1054 if (rw == UIO_READ) {
1055 if (vnode_isswap(vp) && ((ioflg & IO_SWAP_DISPATCH) == 0)) {
1056 error = vn_read_swapfile(vp, auio);
1057 } else {
1058 error = VNOP_READ(vp, auio, ioflg, &context);
1059 }
1060 } else {
1061 error = VNOP_WRITE(vp, auio, ioflg, &context);
1062 }
1063 }
1064
1065 if (aresid) {
1066 *aresid = uio_resid(auio);
1067 assert(*aresid <= len);
1068 } else if (uio_resid(auio) && error == 0) {
1069 error = EIO;
1070 }
1071 return error;
1072 }
1073
1074 void
vn_offset_lock(struct fileglob * fg)1075 vn_offset_lock(struct fileglob *fg)
1076 {
1077 lck_mtx_lock_spin(&fg->fg_lock);
1078 while (fg->fg_lflags & FG_OFF_LOCKED) {
1079 fg->fg_lflags |= FG_OFF_LOCKWANT;
1080 msleep(&fg->fg_lflags, &fg->fg_lock, PVFS | PSPIN,
1081 "fg_offset_lock_wait", 0);
1082 }
1083 fg->fg_lflags |= FG_OFF_LOCKED;
1084 lck_mtx_unlock(&fg->fg_lock);
1085 }
1086
1087 void
vn_offset_unlock(struct fileglob * fg)1088 vn_offset_unlock(struct fileglob *fg)
1089 {
1090 int lock_wanted = 0;
1091
1092 lck_mtx_lock_spin(&fg->fg_lock);
1093 if (fg->fg_lflags & FG_OFF_LOCKWANT) {
1094 lock_wanted = 1;
1095 }
1096 fg->fg_lflags &= ~(FG_OFF_LOCKED | FG_OFF_LOCKWANT);
1097 lck_mtx_unlock(&fg->fg_lock);
1098 if (lock_wanted) {
1099 wakeup(&fg->fg_lflags);
1100 }
1101 }
1102
1103 static int
vn_read_common(vnode_t vp,struct uio * uio,int fflag,vfs_context_t ctx)1104 vn_read_common(vnode_t vp, struct uio *uio, int fflag, vfs_context_t ctx)
1105 {
1106 int error;
1107 int ioflag;
1108 off_t read_offset;
1109 user_ssize_t read_len;
1110 user_ssize_t adjusted_read_len;
1111 user_ssize_t clippedsize;
1112
1113 /* Caller has already validated read_len. */
1114 read_len = uio_resid(uio);
1115 assert(read_len >= 0 && read_len <= INT_MAX);
1116
1117 adjusted_read_len = read_len;
1118 clippedsize = 0;
1119
1120 #if CONFIG_MACF
1121 error = mac_vnode_check_read(ctx, vfs_context_ucred(ctx), vp);
1122 if (error) {
1123 return error;
1124 }
1125 #endif
1126
1127 /* This signals to VNOP handlers that this read came from a file table read */
1128 ioflag = IO_SYSCALL_DISPATCH;
1129
1130 if (fflag & FNONBLOCK) {
1131 ioflag |= IO_NDELAY;
1132 }
1133 if ((fflag & FNOCACHE) || vnode_isnocache(vp)) {
1134 ioflag |= IO_NOCACHE;
1135 }
1136 if (fflag & FENCRYPTED) {
1137 ioflag |= IO_ENCRYPTED;
1138 }
1139 if (fflag & FUNENCRYPTED) {
1140 ioflag |= IO_SKIP_ENCRYPTION;
1141 }
1142 if (fflag & O_EVTONLY) {
1143 ioflag |= IO_EVTONLY;
1144 }
1145 if (fflag & FNORDAHEAD) {
1146 ioflag |= IO_RAOFF;
1147 }
1148
1149 read_offset = uio_offset(uio);
1150 /* POSIX allows negative offsets for character devices. */
1151 if ((read_offset < 0) && (vnode_vtype(vp) != VCHR)) {
1152 error = EINVAL;
1153 goto error_out;
1154 }
1155
1156 if (read_offset == INT64_MAX) {
1157 /* can't read any more */
1158 error = 0;
1159 goto error_out;
1160 }
1161
1162 /*
1163 * If offset + len will cause overflow, reduce the len to a value
1164 * (adjusted_read_len) where it won't
1165 */
1166 if ((read_offset >= 0) && (INT64_MAX - read_offset) < read_len) {
1167 /*
1168 * 0 read_offset INT64_MAX
1169 * |-----------------------------------------------|----------|~~~
1170 * <--read_len-->
1171 * <-adjusted->
1172 */
1173 adjusted_read_len = (user_ssize_t)(INT64_MAX - read_offset);
1174 }
1175
1176 if (adjusted_read_len < read_len) {
1177 uio_setresid(uio, adjusted_read_len);
1178 clippedsize = read_len - adjusted_read_len;
1179 }
1180
1181 if (vnode_isswap(vp) && !(IO_SKIP_ENCRYPTION & ioflag)) {
1182 /* special case for swap files */
1183 error = vn_read_swapfile(vp, uio);
1184 } else {
1185 error = VNOP_READ(vp, uio, ioflag, ctx);
1186 }
1187
1188 if (clippedsize) {
1189 uio_setresid(uio, (uio_resid(uio) + clippedsize));
1190 }
1191
1192 error_out:
1193 return error;
1194 }
1195
1196 /*
1197 * File table vnode read routine.
1198 */
1199 static int
vn_read(struct fileproc * fp,struct uio * uio,int flags,vfs_context_t ctx)1200 vn_read(struct fileproc *fp, struct uio *uio, int flags, vfs_context_t ctx)
1201 {
1202 vnode_t vp;
1203 user_ssize_t read_len;
1204 int error;
1205 bool offset_locked;
1206
1207 read_len = uio_resid(uio);
1208 if (read_len < 0 || read_len > INT_MAX) {
1209 return EINVAL;
1210 }
1211
1212 if ((flags & FOF_OFFSET) == 0) {
1213 vn_offset_lock(fp->fp_glob);
1214 offset_locked = true;
1215 } else {
1216 offset_locked = false;
1217 }
1218 vp = (struct vnode *)fp_get_data(fp);
1219 if ((error = vnode_getwithref(vp))) {
1220 if (offset_locked) {
1221 vn_offset_unlock(fp->fp_glob);
1222 }
1223 return error;
1224 }
1225
1226 if (offset_locked && (vnode_vtype(vp) != VREG || vnode_isswap(vp))) {
1227 vn_offset_unlock(fp->fp_glob);
1228 offset_locked = false;
1229 }
1230
1231 if ((flags & FOF_OFFSET) == 0) {
1232 uio_setoffset(uio, fp->fp_glob->fg_offset);
1233 }
1234
1235 error = vn_read_common(vp, uio, fp->fp_glob->fg_flag, ctx);
1236
1237 if ((flags & FOF_OFFSET) == 0) {
1238 fp->fp_glob->fg_offset += read_len - uio_resid(uio);
1239 }
1240
1241 if (offset_locked) {
1242 vn_offset_unlock(fp->fp_glob);
1243 offset_locked = false;
1244 }
1245
1246 vnode_put(vp);
1247 return error;
1248 }
1249
1250 /*
1251 * File table vnode write routine.
1252 */
1253 static int
vn_write(struct fileproc * fp,struct uio * uio,int flags,vfs_context_t ctx)1254 vn_write(struct fileproc *fp, struct uio *uio, int flags, vfs_context_t ctx)
1255 {
1256 struct vnode *vp;
1257 int error, ioflag;
1258 off_t write_offset;
1259 off_t write_end_offset;
1260 user_ssize_t write_len;
1261 user_ssize_t adjusted_write_len;
1262 user_ssize_t clippedsize;
1263 bool offset_locked;
1264 proc_t p = vfs_context_proc(ctx);
1265 rlim_t rlim_cur_fsize = p ? proc_limitgetcur(p, RLIMIT_FSIZE) : 0;
1266
1267 write_len = uio_resid(uio);
1268 if (write_len < 0 || write_len > INT_MAX) {
1269 return EINVAL;
1270 }
1271 adjusted_write_len = write_len;
1272 clippedsize = 0;
1273
1274 if ((flags & FOF_OFFSET) == 0) {
1275 vn_offset_lock(fp->fp_glob);
1276 offset_locked = true;
1277 } else {
1278 offset_locked = false;
1279 }
1280
1281 vp = (struct vnode *)fp_get_data(fp);
1282 if ((error = vnode_getwithref(vp))) {
1283 if (offset_locked) {
1284 vn_offset_unlock(fp->fp_glob);
1285 }
1286 return error;
1287 }
1288
1289 if (offset_locked && (vnode_vtype(vp) != VREG || vnode_isswap(vp))) {
1290 vn_offset_unlock(fp->fp_glob);
1291 offset_locked = false;
1292 }
1293
1294 #if CONFIG_MACF
1295 error = mac_vnode_check_write(ctx, vfs_context_ucred(ctx), vp);
1296 if (error) {
1297 (void)vnode_put(vp);
1298 if (offset_locked) {
1299 vn_offset_unlock(fp->fp_glob);
1300 }
1301 return error;
1302 }
1303 #endif
1304
1305 /*
1306 * IO_SYSCALL_DISPATCH signals to VNOP handlers that this write came from
1307 * a file table write
1308 */
1309 ioflag = (IO_UNIT | IO_SYSCALL_DISPATCH);
1310
1311 if (vp->v_type == VREG && (fp->fp_glob->fg_flag & O_APPEND)) {
1312 ioflag |= IO_APPEND;
1313 }
1314 if (fp->fp_glob->fg_flag & FNONBLOCK) {
1315 ioflag |= IO_NDELAY;
1316 }
1317 assert(!(fp->fp_glob->fg_flag & O_NOCTTY) || (fp->fp_glob->fg_flag & FNOCACHE));
1318 if ((fp->fp_glob->fg_flag & FNOCACHE) || vnode_isnocache(vp)) {
1319 ioflag |= IO_NOCACHE;
1320 /*
1321 * O_NOCTTY is repurposed to indicate the preference for relaxed
1322 * alignment and size restrictions. O_NOCTTY has no meaning beyond
1323 * the open of the fd and is used only for ttys and the use
1324 * is mutually exclusive with nocache io for regular files.
1325 */
1326 if (fp->fp_glob->fg_flag & O_NOCTTY || vfs_context_allow_fs_blksize_nocache_write(ctx)) {
1327 ioflag |= IO_NOCACHE_SWRITE;
1328 }
1329 }
1330 if (fp->fp_glob->fg_flag & FNODIRECT) {
1331 ioflag |= IO_NODIRECT;
1332 }
1333 if (fp->fp_glob->fg_flag & FSINGLE_WRITER) {
1334 ioflag |= IO_SINGLE_WRITER;
1335 }
1336 if (fp->fp_glob->fg_flag & O_EVTONLY) {
1337 ioflag |= IO_EVTONLY;
1338 }
1339
1340 /*
1341 * Treat synchronous mounts and O_FSYNC on the fd as equivalent.
1342 *
1343 * XXX We treat O_DSYNC as O_FSYNC for now, since we can not delay
1344 * XXX the non-essential metadata without some additional VFS work;
1345 * XXX the intent at this point is to plumb the interface for it.
1346 */
1347 if ((fp->fp_glob->fg_flag & (O_FSYNC | O_DSYNC)) ||
1348 (vp->v_mount && (vp->v_mount->mnt_flag & MNT_SYNCHRONOUS))) {
1349 ioflag |= IO_SYNC;
1350 }
1351
1352 if ((flags & FOF_OFFSET) == 0) {
1353 write_offset = fp->fp_glob->fg_offset;
1354 uio_setoffset(uio, write_offset);
1355 } else {
1356 /* for pwrite, append should be ignored */
1357 ioflag &= ~IO_APPEND;
1358 write_offset = uio_offset(uio);
1359 /* POSIX allows negative offsets for character devices. */
1360 if ((write_offset < 0) && (vnode_vtype(vp) != VCHR)) {
1361 error = EINVAL;
1362 goto error_out;
1363 }
1364 }
1365
1366 if (write_offset == INT64_MAX) {
1367 /* writes are not possible */
1368 error = EFBIG;
1369 goto error_out;
1370 }
1371
1372 /*
1373 * write_len is the original write length that was requested.
1374 * We may however need to reduce that becasue of two reasons
1375 *
1376 * 1) If write_offset + write_len will exceed OFF_T_MAX (i.e. INT64_MAX)
1377 * and/or
1378 * 2) If write_offset + write_len will exceed the administrative
1379 * limit for the maximum file size.
1380 *
1381 * In both cases the write will be denied if we can't write even a single
1382 * byte otherwise it will be "clipped" (i.e. a short write).
1383 */
1384
1385 /*
1386 * If offset + len will cause overflow, reduce the len
1387 * to a value (adjusted_write_len) where it won't
1388 */
1389 if ((write_offset >= 0) && (INT64_MAX - write_offset) < write_len) {
1390 /*
1391 * 0 write_offset INT64_MAX
1392 * |-----------------------------------------------|----------|~~~
1393 * <--write_len-->
1394 * <-adjusted->
1395 */
1396 adjusted_write_len = (user_ssize_t)(INT64_MAX - write_offset);
1397 }
1398
1399 /* write_end_offset will always be [0, INT64_MAX] */
1400 write_end_offset = write_offset + adjusted_write_len;
1401
1402 if (p && (vp->v_type == VREG) &&
1403 (rlim_cur_fsize != RLIM_INFINITY) &&
1404 (rlim_cur_fsize <= INT64_MAX) &&
1405 (write_end_offset > (off_t)rlim_cur_fsize)) {
1406 /*
1407 * If the requested residual would cause us to go past the
1408 * administrative limit, then we need to adjust the residual
1409 * down to cause fewer bytes than requested to be written. If
1410 * we can't do that (e.g. the residual is already 1 byte),
1411 * then we fail the write with EFBIG.
1412 */
1413 if (write_offset >= (off_t)rlim_cur_fsize) {
1414 /*
1415 * 0 rlim_fsize write_offset write_end INT64_MAX
1416 * |------------------------|----------|-------------|--------|
1417 * <--write_len-->
1418 *
1419 * write not permitted
1420 */
1421 psignal(p, SIGXFSZ);
1422 error = EFBIG;
1423 goto error_out;
1424 }
1425
1426 /*
1427 * 0 write_offset rlim_fsize write_end INT64_MAX
1428 * |------------------------|-----------|---------|------------|
1429 * <------write_len------>
1430 * <-adjusted-->
1431 */
1432 adjusted_write_len = (user_ssize_t)((off_t)rlim_cur_fsize - write_offset);
1433 assert((adjusted_write_len > 0) && (adjusted_write_len < write_len));
1434 }
1435
1436 if (adjusted_write_len < write_len) {
1437 uio_setresid(uio, adjusted_write_len);
1438 clippedsize = write_len - adjusted_write_len;
1439 }
1440
1441 error = VNOP_WRITE(vp, uio, ioflag, ctx);
1442
1443 /*
1444 * If we had to reduce the size of write requested either because
1445 * of rlimit or because it would have exceeded
1446 * maximum file size, we have to add that back to the residual so
1447 * it correctly reflects what we did in this function.
1448 */
1449 if (clippedsize) {
1450 uio_setresid(uio, (uio_resid(uio) + clippedsize));
1451 }
1452
1453 if ((flags & FOF_OFFSET) == 0) {
1454 if (ioflag & IO_APPEND) {
1455 fp->fp_glob->fg_offset = uio_offset(uio);
1456 } else {
1457 fp->fp_glob->fg_offset += (write_len - uio_resid(uio));
1458 }
1459 if (offset_locked) {
1460 vn_offset_unlock(fp->fp_glob);
1461 offset_locked = false;
1462 }
1463 }
1464
1465 /*
1466 * Set the credentials on successful writes
1467 */
1468 if ((error == 0) && (vp->v_tag == VT_NFS) && (UBCINFOEXISTS(vp))) {
1469 ubc_setcred(vp, vfs_context_ucred(ctx));
1470 }
1471
1472 #if CONFIG_FILE_LEASES
1473 /*
1474 * On success, break the parent dir lease as the file's attributes (size
1475 * and/or mtime) have changed. Best attempt to break lease, just drop the
1476 * the error upon failure as there is no point to return error when the
1477 * write has completed successfully.
1478 */
1479 if (__probable(error == 0)) {
1480 vnode_breakdirlease(vp, true, O_WRONLY);
1481 }
1482 #endif /* CONFIG_FILE_LEASES */
1483
1484 (void)vnode_put(vp);
1485 return error;
1486
1487 error_out:
1488 if (offset_locked) {
1489 vn_offset_unlock(fp->fp_glob);
1490 }
1491 (void)vnode_put(vp);
1492 return error;
1493 }
1494
1495 /*
1496 * File table vnode stat routine.
1497 *
1498 * Returns: 0 Success
1499 * EBADF
1500 * ENOMEM
1501 * vnode_getattr:???
1502 */
1503 int
vn_stat_noauth(struct vnode * vp,void * sbptr,kauth_filesec_t * xsec,int isstat64,int needsrealdev,vfs_context_t ctx,struct ucred * file_cred)1504 vn_stat_noauth(struct vnode *vp, void *sbptr, kauth_filesec_t *xsec, int isstat64,
1505 int needsrealdev, vfs_context_t ctx, struct ucred *file_cred)
1506 {
1507 struct vnode_attr va;
1508 int error;
1509 u_short mode;
1510 kauth_filesec_t fsec;
1511 struct stat *sb = (struct stat *)0; /* warning avoidance ; protected by isstat64 */
1512 struct stat64 * sb64 = (struct stat64 *)0; /* warning avoidance ; protected by isstat64 */
1513
1514 if (isstat64 != 0) {
1515 sb64 = (struct stat64 *)sbptr;
1516 } else {
1517 sb = (struct stat *)sbptr;
1518 }
1519 memset(&va, 0, sizeof(va));
1520 VATTR_INIT(&va);
1521 VATTR_WANTED(&va, va_fsid);
1522 VATTR_WANTED(&va, va_fileid);
1523 VATTR_WANTED(&va, va_mode);
1524 VATTR_WANTED(&va, va_type);
1525 VATTR_WANTED(&va, va_nlink);
1526 VATTR_WANTED(&va, va_uid);
1527 VATTR_WANTED(&va, va_gid);
1528 VATTR_WANTED(&va, va_rdev);
1529 VATTR_WANTED(&va, va_data_size);
1530 VATTR_WANTED(&va, va_access_time);
1531 VATTR_WANTED(&va, va_modify_time);
1532 VATTR_WANTED(&va, va_change_time);
1533 VATTR_WANTED(&va, va_create_time);
1534 VATTR_WANTED(&va, va_flags);
1535 VATTR_WANTED(&va, va_gen);
1536 VATTR_WANTED(&va, va_iosize);
1537 /* lower layers will synthesise va_total_alloc from va_data_size if required */
1538 VATTR_WANTED(&va, va_total_alloc);
1539 if (xsec != NULL && !vnode_isnamedstream(vp)) {
1540 VATTR_WANTED(&va, va_uuuid);
1541 VATTR_WANTED(&va, va_guuid);
1542 VATTR_WANTED(&va, va_acl);
1543 }
1544 if (needsrealdev) {
1545 va.va_vaflags = VA_REALFSID;
1546 }
1547 error = vnode_getattr(vp, &va, ctx);
1548 if (error) {
1549 goto out;
1550 }
1551 #if CONFIG_MACF
1552 /*
1553 * Give MAC polices a chance to reject or filter the attributes
1554 * returned by the filesystem. Note that MAC policies are consulted
1555 * *after* calling the filesystem because filesystems can return more
1556 * attributes than were requested so policies wouldn't be authoritative
1557 * is consulted beforehand. This also gives policies an opportunity
1558 * to change the values of attributes retrieved.
1559 */
1560 error = mac_vnode_check_getattr(ctx, file_cred, vp, &va);
1561 if (error) {
1562 goto out;
1563 }
1564 #endif
1565 /*
1566 * Copy from vattr table
1567 */
1568 if (isstat64 != 0) {
1569 sb64->st_dev = va.va_fsid;
1570 sb64->st_ino = (ino64_t)va.va_fileid;
1571 } else {
1572 sb->st_dev = va.va_fsid;
1573 sb->st_ino = (ino_t)va.va_fileid;
1574 }
1575 mode = va.va_mode;
1576 switch (vp->v_type) {
1577 case VREG:
1578 mode |= S_IFREG;
1579 break;
1580 case VDIR:
1581 mode |= S_IFDIR;
1582 break;
1583 case VBLK:
1584 mode |= S_IFBLK;
1585 break;
1586 case VCHR:
1587 mode |= S_IFCHR;
1588 break;
1589 case VLNK:
1590 mode |= S_IFLNK;
1591 break;
1592 case VSOCK:
1593 mode |= S_IFSOCK;
1594 break;
1595 case VFIFO:
1596 mode |= S_IFIFO;
1597 break;
1598 default:
1599 error = EBADF;
1600 goto out;
1601 }
1602 ;
1603 if (isstat64 != 0) {
1604 sb64->st_mode = mode;
1605 sb64->st_nlink = VATTR_IS_SUPPORTED(&va, va_nlink) ? va.va_nlink > UINT16_MAX ? UINT16_MAX : (u_int16_t)va.va_nlink : 1;
1606 sb64->st_uid = va.va_uid;
1607 sb64->st_gid = va.va_gid;
1608 sb64->st_rdev = va.va_rdev;
1609 sb64->st_size = va.va_data_size;
1610 sb64->st_atimespec = va.va_access_time;
1611 sb64->st_mtimespec = va.va_modify_time;
1612 sb64->st_ctimespec = va.va_change_time;
1613 if (VATTR_IS_SUPPORTED(&va, va_create_time)) {
1614 sb64->st_birthtimespec = va.va_create_time;
1615 } else {
1616 sb64->st_birthtimespec.tv_sec = sb64->st_birthtimespec.tv_nsec = 0;
1617 }
1618 sb64->st_blksize = va.va_iosize;
1619 sb64->st_flags = va.va_flags;
1620 sb64->st_blocks = roundup(va.va_total_alloc, 512) / 512;
1621 } else {
1622 sb->st_mode = mode;
1623 sb->st_nlink = VATTR_IS_SUPPORTED(&va, va_nlink) ? va.va_nlink > UINT16_MAX ? UINT16_MAX : (u_int16_t)va.va_nlink : 1;
1624 sb->st_uid = va.va_uid;
1625 sb->st_gid = va.va_gid;
1626 sb->st_rdev = va.va_rdev;
1627 sb->st_size = va.va_data_size;
1628 sb->st_atimespec = va.va_access_time;
1629 sb->st_mtimespec = va.va_modify_time;
1630 sb->st_ctimespec = va.va_change_time;
1631 sb->st_blksize = va.va_iosize;
1632 sb->st_flags = va.va_flags;
1633 sb->st_blocks = roundup(va.va_total_alloc, 512) / 512;
1634 }
1635
1636 /* if we're interested in extended security data and we got an ACL */
1637 if (xsec != NULL) {
1638 if (!VATTR_IS_SUPPORTED(&va, va_acl) &&
1639 !VATTR_IS_SUPPORTED(&va, va_uuuid) &&
1640 !VATTR_IS_SUPPORTED(&va, va_guuid)) {
1641 *xsec = KAUTH_FILESEC_NONE;
1642 } else {
1643 if (VATTR_IS_SUPPORTED(&va, va_acl) && (va.va_acl != NULL)) {
1644 fsec = kauth_filesec_alloc(va.va_acl->acl_entrycount);
1645 } else {
1646 fsec = kauth_filesec_alloc(0);
1647 }
1648 if (fsec == NULL) {
1649 error = ENOMEM;
1650 goto out;
1651 }
1652 fsec->fsec_magic = KAUTH_FILESEC_MAGIC;
1653 if (VATTR_IS_SUPPORTED(&va, va_uuuid)) {
1654 fsec->fsec_owner = va.va_uuuid;
1655 } else {
1656 fsec->fsec_owner = kauth_null_guid;
1657 }
1658 if (VATTR_IS_SUPPORTED(&va, va_guuid)) {
1659 fsec->fsec_group = va.va_guuid;
1660 } else {
1661 fsec->fsec_group = kauth_null_guid;
1662 }
1663 if (VATTR_IS_SUPPORTED(&va, va_acl) && (va.va_acl != NULL)) {
1664 __nochk_bcopy(va.va_acl, &(fsec->fsec_acl), KAUTH_ACL_COPYSIZE(va.va_acl));
1665 } else {
1666 fsec->fsec_acl.acl_entrycount = KAUTH_FILESEC_NOACL;
1667 }
1668 *xsec = fsec;
1669 }
1670 }
1671
1672 /* Do not give the generation number out to unpriviledged users */
1673 if (va.va_gen && !vfs_context_issuser(ctx)) {
1674 if (isstat64 != 0) {
1675 sb64->st_gen = 0;
1676 } else {
1677 sb->st_gen = 0;
1678 }
1679 } else {
1680 if (isstat64 != 0) {
1681 sb64->st_gen = va.va_gen;
1682 } else {
1683 sb->st_gen = va.va_gen;
1684 }
1685 }
1686
1687 error = 0;
1688 out:
1689 if (VATTR_IS_SUPPORTED(&va, va_acl) && va.va_acl != NULL) {
1690 kauth_acl_free(va.va_acl);
1691 }
1692 return error;
1693 }
1694
1695 int
vn_stat(struct vnode * vp,void * sb,kauth_filesec_t * xsec,int isstat64,int needsrealdev,vfs_context_t ctx)1696 vn_stat(struct vnode *vp, void *sb, kauth_filesec_t *xsec, int isstat64, int needsrealdev, vfs_context_t ctx)
1697 {
1698 int error;
1699
1700 #if CONFIG_MACF
1701 error = mac_vnode_check_stat(ctx, NOCRED, vp);
1702 if (error) {
1703 return error;
1704 }
1705 #endif
1706
1707 /* authorize */
1708 if ((error = vnode_authorize(vp, NULL, KAUTH_VNODE_READ_ATTRIBUTES | KAUTH_VNODE_READ_SECURITY, ctx)) != 0) {
1709 return error;
1710 }
1711
1712 /* actual stat */
1713 return vn_stat_noauth(vp, sb, xsec, isstat64, needsrealdev, ctx, NOCRED);
1714 }
1715
1716
1717 /*
1718 * File table vnode ioctl routine.
1719 */
1720 static int
vn_ioctl(struct fileproc * fp,u_long com,caddr_t data,vfs_context_t ctx)1721 vn_ioctl(struct fileproc *fp, u_long com, caddr_t data, vfs_context_t ctx)
1722 {
1723 struct vnode *vp = (struct vnode *)fp_get_data(fp);
1724 off_t file_size;
1725 int error;
1726 struct vnode *ttyvp;
1727
1728 if ((error = vnode_getwithref(vp))) {
1729 return error;
1730 }
1731
1732 #if CONFIG_MACF
1733 error = mac_vnode_check_ioctl(ctx, vp, com);
1734 if (error) {
1735 goto out;
1736 }
1737 #endif
1738
1739 switch (vp->v_type) {
1740 case VREG:
1741 case VDIR:
1742 if (com == FIONREAD) {
1743 off_t temp_nbytes;
1744 if ((error = vnode_size(vp, &file_size, ctx)) != 0) {
1745 goto out;
1746 }
1747 temp_nbytes = file_size - fp->fp_glob->fg_offset;
1748 if (temp_nbytes > INT_MAX) {
1749 *(int *)data = INT_MAX;
1750 } else if (temp_nbytes < 0) {
1751 *(int *)data = 0;
1752 } else {
1753 *(int *)data = (int)temp_nbytes;
1754 }
1755 goto out;
1756 }
1757 if (com == FIONBIO || com == FIOASYNC) { /* XXX */
1758 goto out;
1759 }
1760 OS_FALLTHROUGH;
1761
1762 default:
1763 error = ENOTTY;
1764 goto out;
1765
1766 case VFIFO:
1767 case VCHR:
1768 case VBLK:
1769
1770 if (com == TIOCREVOKE || com == TIOCREVOKECLEAR) {
1771 error = ENOTTY;
1772 goto out;
1773 }
1774
1775 /* Should not be able to set block size from user space */
1776 if (com == DKIOCSETBLOCKSIZE) {
1777 error = EPERM;
1778 goto out;
1779 }
1780
1781 /* Should not be able to check if filesystem is authenticated from user space */
1782 if (com == FSIOC_AUTH_FS) {
1783 error = ENOTTY;
1784 goto out;
1785 }
1786
1787 if (com == FIODTYPE) {
1788 if (vp->v_type == VBLK) {
1789 if (major(vp->v_rdev) >= nblkdev) {
1790 error = ENXIO;
1791 goto out;
1792 }
1793 *(int *)data = bdevsw[major(vp->v_rdev)].d_type;
1794 } else if (vp->v_type == VCHR) {
1795 if (major(vp->v_rdev) >= nchrdev) {
1796 error = ENXIO;
1797 goto out;
1798 }
1799 *(int *)data = cdevsw[major(vp->v_rdev)].d_type;
1800 } else {
1801 error = ENOTTY;
1802 goto out;
1803 }
1804 goto out;
1805 }
1806 error = VNOP_IOCTL(vp, com, data, fp->fp_glob->fg_flag, ctx);
1807
1808 if (error == 0 && com == TIOCSCTTY) {
1809 struct session *sessp;
1810 struct pgrp *pg;
1811
1812 pg = proc_pgrp(vfs_context_proc(ctx), &sessp);
1813
1814 session_lock(sessp);
1815 ttyvp = sessp->s_ttyvp;
1816 sessp->s_ttyvp = vp;
1817 sessp->s_ttyvid = vnode_vid(vp);
1818 session_unlock(sessp);
1819
1820 pgrp_rele(pg);
1821 }
1822 }
1823 out:
1824 (void)vnode_put(vp);
1825 return error;
1826 }
1827
1828 /*
1829 * File table vnode select routine.
1830 */
1831 static int
vn_select(struct fileproc * fp,int which,void * wql,__unused vfs_context_t ctx)1832 vn_select(struct fileproc *fp, int which, void *wql, __unused vfs_context_t ctx)
1833 {
1834 int error;
1835 struct vnode * vp = (struct vnode *)fp_get_data(fp);
1836 struct vfs_context context;
1837
1838 if ((error = vnode_getwithref(vp)) == 0) {
1839 context.vc_thread = current_thread();
1840 context.vc_ucred = fp->fp_glob->fg_cred;
1841
1842 #if CONFIG_MACF
1843 /*
1844 * XXX We should use a per thread credential here; minimally,
1845 * XXX the process credential should have a persistent
1846 * XXX reference on it before being passed in here.
1847 */
1848 error = mac_vnode_check_select(ctx, vp, which);
1849 if (error == 0)
1850 #endif
1851 error = VNOP_SELECT(vp, which, fp->fp_glob->fg_flag, wql, ctx);
1852
1853 (void)vnode_put(vp);
1854 }
1855 return error;
1856 }
1857
1858 /*
1859 * File table vnode close routine.
1860 */
1861 static int
vn_closefile(struct fileglob * fg,vfs_context_t ctx)1862 vn_closefile(struct fileglob *fg, vfs_context_t ctx)
1863 {
1864 struct vnode *vp = fg_get_data(fg);
1865 int error;
1866
1867 if ((error = vnode_getwithref(vp)) == 0) {
1868 if (FILEGLOB_DTYPE(fg) == DTYPE_VNODE &&
1869 ((fg->fg_flag & FWASLOCKED) != 0 ||
1870 (fg->fg_lflags & FG_HAS_OFDLOCK) != 0)) {
1871 struct flock lf = {
1872 .l_whence = SEEK_SET,
1873 .l_start = 0,
1874 .l_len = 0,
1875 .l_type = F_UNLCK
1876 };
1877
1878 if ((fg->fg_flag & FWASLOCKED) != 0) {
1879 (void) VNOP_ADVLOCK(vp, (caddr_t)fg,
1880 F_UNLCK, &lf, F_FLOCK, ctx, NULL);
1881 }
1882
1883 if ((fg->fg_lflags & FG_HAS_OFDLOCK) != 0) {
1884 (void) VNOP_ADVLOCK(vp, ofd_to_id(fg),
1885 F_UNLCK, &lf, F_OFD_LOCK, ctx, NULL);
1886 }
1887 }
1888 #if CONFIG_FILE_LEASES
1889 if (FILEGLOB_DTYPE(fg) == DTYPE_VNODE && !LIST_EMPTY(&vp->v_leases)) {
1890 /* Expected open count doesn't matter for release. */
1891 (void)vnode_setlease(vp, fg, F_UNLCK, 0, ctx);
1892 }
1893 #endif
1894 error = vn_close(vp, fg->fg_flag, ctx);
1895 (void) vnode_put(vp);
1896 }
1897 return error;
1898 }
1899
1900 /*
1901 * Returns: 0 Success
1902 * VNOP_PATHCONF:???
1903 */
1904 int
vn_pathconf(vnode_t vp,int name,int32_t * retval,vfs_context_t ctx)1905 vn_pathconf(vnode_t vp, int name, int32_t *retval, vfs_context_t ctx)
1906 {
1907 int error = 0;
1908 struct vfs_attr vfa;
1909
1910 switch (name) {
1911 case _PC_EXTENDED_SECURITY_NP:
1912 *retval = vfs_extendedsecurity(vnode_mount(vp)) ? 1 : 0;
1913 break;
1914 case _PC_AUTH_OPAQUE_NP:
1915 *retval = vfs_authopaque(vnode_mount(vp));
1916 break;
1917 case _PC_2_SYMLINKS:
1918 *retval = 1; /* XXX NOTSUP on MSDOS, etc. */
1919 break;
1920 case _PC_ALLOC_SIZE_MIN:
1921 *retval = 1; /* XXX lie: 1 byte */
1922 break;
1923 case _PC_ASYNC_IO: /* unistd.h: _POSIX_ASYNCHRONUS_IO */
1924 *retval = 1; /* [AIO] option is supported */
1925 break;
1926 case _PC_PRIO_IO: /* unistd.h: _POSIX_PRIORITIZED_IO */
1927 *retval = 0; /* [PIO] option is not supported */
1928 break;
1929 case _PC_REC_INCR_XFER_SIZE:
1930 *retval = 4096; /* XXX go from MIN to MAX 4K at a time */
1931 break;
1932 case _PC_REC_MIN_XFER_SIZE:
1933 *retval = 4096; /* XXX recommend 4K minimum reads/writes */
1934 break;
1935 case _PC_REC_MAX_XFER_SIZE:
1936 *retval = 65536; /* XXX recommend 64K maximum reads/writes */
1937 break;
1938 case _PC_REC_XFER_ALIGN:
1939 *retval = 4096; /* XXX recommend page aligned buffers */
1940 break;
1941 case _PC_SYMLINK_MAX:
1942 *retval = 255; /* Minimum acceptable POSIX value */
1943 break;
1944 case _PC_SYNC_IO: /* unistd.h: _POSIX_SYNCHRONIZED_IO */
1945 *retval = 0; /* [SIO] option is not supported */
1946 break;
1947 case _PC_XATTR_SIZE_BITS:
1948 /* The number of bits used to store maximum extended
1949 * attribute size in bytes. For example, if the maximum
1950 * attribute size supported by a file system is 128K, the
1951 * value returned will be 18. However a value 18 can mean
1952 * that the maximum attribute size can be anywhere from
1953 * (256KB - 1) to 128KB. As a special case, the resource
1954 * fork can have much larger size, and some file system
1955 * specific extended attributes can have smaller and preset
1956 * size; for example, Finder Info is always 32 bytes.
1957 */
1958 memset(&vfa, 0, sizeof(vfa));
1959 VFSATTR_INIT(&vfa);
1960 VFSATTR_WANTED(&vfa, f_capabilities);
1961 if (vfs_getattr(vnode_mount(vp), &vfa, ctx) == 0 &&
1962 (VFSATTR_IS_SUPPORTED(&vfa, f_capabilities)) &&
1963 (vfa.f_capabilities.capabilities[VOL_CAPABILITIES_INTERFACES] & VOL_CAP_INT_EXTENDED_ATTR) &&
1964 (vfa.f_capabilities.valid[VOL_CAPABILITIES_INTERFACES] & VOL_CAP_INT_EXTENDED_ATTR)) {
1965 /* Supports native extended attributes */
1966 error = VNOP_PATHCONF(vp, name, retval, ctx);
1967 } else {
1968 /* Number of bits used to represent the maximum size of
1969 * extended attribute stored in an Apple Double file.
1970 */
1971 *retval = AD_XATTR_SIZE_BITS;
1972 }
1973 break;
1974 default:
1975 error = VNOP_PATHCONF(vp, name, retval, ctx);
1976 break;
1977 }
1978
1979 return error;
1980 }
1981
1982 static int
vn_kqfilter(struct fileproc * fp,struct knote * kn,struct kevent_qos_s * kev)1983 vn_kqfilter(struct fileproc *fp, struct knote *kn, struct kevent_qos_s *kev)
1984 {
1985 vfs_context_t ctx = vfs_context_current();
1986 struct vnode *vp;
1987 int error = 0;
1988 int result = 0;
1989
1990 vp = (struct vnode *)fp_get_data(fp);
1991
1992 /*
1993 * Don't attach a knote to a dead vnode.
1994 */
1995 if ((error = vget_internal(vp, 0, VNODE_NODEAD)) == 0) {
1996 switch (kn->kn_filter) {
1997 case EVFILT_READ:
1998 case EVFILT_WRITE:
1999 if (vnode_isfifo(vp)) {
2000 /* We'll only watch FIFOs that use our fifofs */
2001 if (!(vp->v_fifoinfo && vp->v_fifoinfo->fi_readsock)) {
2002 error = ENOTSUP;
2003 }
2004 } else if (!vnode_isreg(vp)) {
2005 if (vnode_ischr(vp)) {
2006 result = spec_kqfilter(vp, kn, kev);
2007 if ((kn->kn_flags & EV_ERROR) == 0) {
2008 /* claimed by a special device */
2009 vnode_put(vp);
2010 return result;
2011 }
2012 }
2013 error = EINVAL;
2014 }
2015 break;
2016 case EVFILT_VNODE:
2017 break;
2018 default:
2019 error = EINVAL;
2020 }
2021
2022 if (error == 0) {
2023 #if CONFIG_MACF
2024 error = mac_vnode_check_kqfilter(ctx, fp->fp_glob->fg_cred, kn, vp);
2025 if (error) {
2026 vnode_put(vp);
2027 goto out;
2028 }
2029 #endif
2030
2031 kn->kn_filtid = EVFILTID_VN;
2032 knote_kn_hook_set_raw(kn, (void *)vp);
2033 vnode_hold(vp);
2034
2035 vnode_lock(vp);
2036 KNOTE_ATTACH(&vp->v_knotes, kn);
2037 result = filt_vnode_common(kn, NULL, vp, 0);
2038 vnode_unlock(vp);
2039
2040 /*
2041 * Ask the filesystem to provide remove notifications,
2042 * but ignore failure
2043 */
2044 VNOP_MONITOR(vp, 0, VNODE_MONITOR_BEGIN, (void*) kn, ctx);
2045 }
2046
2047 vnode_put(vp);
2048 }
2049
2050 out:
2051 if (error) {
2052 knote_set_error(kn, error);
2053 }
2054
2055 return result;
2056 }
2057
2058 static void
filt_vndetach(struct knote * kn)2059 filt_vndetach(struct knote *kn)
2060 {
2061 vfs_context_t ctx = vfs_context_current();
2062 struct vnode *vp = (struct vnode *)knote_kn_hook_get_raw(kn);
2063 uint32_t vid = vnode_vid(vp);
2064 if (vnode_getwithvid(vp, vid)) {
2065 vnode_drop(vp);
2066 return;
2067 }
2068 vnode_drop(vp);
2069
2070 vnode_lock(vp);
2071 KNOTE_DETACH(&vp->v_knotes, kn);
2072 vnode_unlock(vp);
2073
2074 /*
2075 * Tell a (generally networked) filesystem that we're no longer watching
2076 * If the FS wants to track contexts, it should still be using the one from
2077 * the VNODE_MONITOR_BEGIN.
2078 */
2079 VNOP_MONITOR(vp, 0, VNODE_MONITOR_END, (void*)kn, ctx);
2080 vnode_put(vp);
2081 }
2082
2083
2084 /*
2085 * Used for EVFILT_READ
2086 *
2087 * Takes only VFIFO or VREG. vnode is locked. We handle the "poll" case
2088 * differently than the regular case for VREG files. If not in poll(),
2089 * then we need to know current fileproc offset for VREG.
2090 */
2091 static int64_t
vnode_readable_data_count(vnode_t vp,off_t current_offset,int ispoll)2092 vnode_readable_data_count(vnode_t vp, off_t current_offset, int ispoll)
2093 {
2094 if (vnode_isfifo(vp)) {
2095 #if FIFO
2096 int cnt;
2097 int err = fifo_charcount(vp, &cnt);
2098 if (err == 0) {
2099 return (int64_t)cnt;
2100 } else
2101 #endif
2102 {
2103 return 0;
2104 }
2105 } else if (vnode_isreg(vp)) {
2106 if (ispoll) {
2107 return 1;
2108 }
2109
2110 off_t amount;
2111 amount = vp->v_un.vu_ubcinfo->ui_size - current_offset;
2112 if (amount > INT64_MAX) {
2113 return INT64_MAX;
2114 } else if (amount < INT64_MIN) {
2115 return INT64_MIN;
2116 } else {
2117 return (int64_t)amount;
2118 }
2119 } else {
2120 panic("Should never have an EVFILT_READ except for reg or fifo.");
2121 return 0;
2122 }
2123 }
2124
2125 /*
2126 * Used for EVFILT_WRITE.
2127 *
2128 * For regular vnodes, we can always write (1). For named pipes,
2129 * see how much space there is in the buffer. Nothing else is covered.
2130 */
2131 static intptr_t
vnode_writable_space_count(vnode_t vp)2132 vnode_writable_space_count(vnode_t vp)
2133 {
2134 if (vnode_isfifo(vp)) {
2135 #if FIFO
2136 long spc;
2137 int err = fifo_freespace(vp, &spc);
2138 if (err == 0) {
2139 return (intptr_t)spc;
2140 } else
2141 #endif
2142 {
2143 return (intptr_t)0;
2144 }
2145 } else if (vnode_isreg(vp)) {
2146 return (intptr_t)1;
2147 } else {
2148 panic("Should never have an EVFILT_READ except for reg or fifo.");
2149 return 0;
2150 }
2151 }
2152
2153 /*
2154 * Determine whether this knote should be active
2155 *
2156 * This is kind of subtle.
2157 * --First, notice if the vnode has been revoked: in so, override hint
2158 * --EVFILT_READ knotes are checked no matter what the hint is
2159 * --Other knotes activate based on hint.
2160 * --If hint is revoke, set special flags and activate
2161 */
2162 static int
filt_vnode_common(struct knote * kn,struct kevent_qos_s * kev,vnode_t vp,long hint)2163 filt_vnode_common(struct knote *kn, struct kevent_qos_s *kev, vnode_t vp, long hint)
2164 {
2165 int activate = 0;
2166 int64_t data = 0;
2167
2168 lck_mtx_assert(&vp->v_lock, LCK_MTX_ASSERT_OWNED);
2169
2170 /* Special handling for vnodes that are in recycle or already gone */
2171 if (NOTE_REVOKE == hint) {
2172 kn->kn_flags |= (EV_EOF | EV_ONESHOT);
2173 activate = 1;
2174
2175 if ((kn->kn_filter == EVFILT_VNODE) && (kn->kn_sfflags & NOTE_REVOKE)) {
2176 kn->kn_fflags |= NOTE_REVOKE;
2177 }
2178 } else {
2179 switch (kn->kn_filter) {
2180 case EVFILT_READ:
2181 data = vnode_readable_data_count(vp, kn->kn_fp->fp_glob->fg_offset, (kn->kn_flags & EV_POLL));
2182 activate = (data != 0);
2183 break;
2184 case EVFILT_WRITE:
2185 data = vnode_writable_space_count(vp);
2186 activate = (data != 0);
2187 break;
2188 case EVFILT_VNODE:
2189 /* Check events this note matches against the hint */
2190 if (kn->kn_sfflags & hint) {
2191 kn->kn_fflags |= (uint32_t)hint; /* Set which event occurred */
2192 }
2193 activate = (kn->kn_fflags != 0);
2194 break;
2195 default:
2196 panic("Invalid knote filter on a vnode!");
2197 }
2198 }
2199
2200 if (kev && activate) {
2201 knote_fill_kevent(kn, kev, data);
2202 }
2203
2204 return activate;
2205 }
2206
2207 static int
filt_vnode(struct knote * kn,long hint)2208 filt_vnode(struct knote *kn, long hint)
2209 {
2210 vnode_t vp = (struct vnode *)knote_kn_hook_get_raw(kn);
2211
2212 return filt_vnode_common(kn, NULL, vp, hint);
2213 }
2214
2215 static int
filt_vntouch(struct knote * kn,struct kevent_qos_s * kev)2216 filt_vntouch(struct knote *kn, struct kevent_qos_s *kev)
2217 {
2218 vnode_t vp = (struct vnode *)knote_kn_hook_get_raw(kn);
2219 uint32_t vid = vnode_vid(vp);
2220 int activate;
2221 int hint = 0;
2222
2223 vnode_lock(vp);
2224 if (vnode_getiocount(vp, vid, VNODE_NODEAD | VNODE_WITHID) != 0) {
2225 /* is recycled */
2226 hint = NOTE_REVOKE;
2227 }
2228
2229 /* accept new input fflags mask */
2230 kn->kn_sfflags = kev->fflags;
2231
2232 activate = filt_vnode_common(kn, NULL, vp, hint);
2233
2234 if (hint == 0) {
2235 vnode_put_locked(vp);
2236 }
2237 vnode_unlock(vp);
2238
2239 return activate;
2240 }
2241
2242 static int
filt_vnprocess(struct knote * kn,struct kevent_qos_s * kev)2243 filt_vnprocess(struct knote *kn, struct kevent_qos_s *kev)
2244 {
2245 vnode_t vp = (struct vnode *)knote_kn_hook_get_raw(kn);
2246 uint32_t vid = vnode_vid(vp);
2247 int activate;
2248 int hint = 0;
2249
2250 vnode_lock(vp);
2251 if (vnode_getiocount(vp, vid, VNODE_NODEAD | VNODE_WITHID) != 0) {
2252 /* Is recycled */
2253 hint = NOTE_REVOKE;
2254 }
2255 activate = filt_vnode_common(kn, kev, vp, hint);
2256
2257 /* Definitely need to unlock, may need to put */
2258 if (hint == 0) {
2259 vnode_put_locked(vp);
2260 }
2261 vnode_unlock(vp);
2262
2263 return activate;
2264 }
2265
2266 struct vniodesc {
2267 vnode_t vnio_vnode; /* associated vnode */
2268 int vnio_fflags; /* cached fileglob flags */
2269 };
2270
2271 errno_t
vnio_openfd(int fd,vniodesc_t * vniop)2272 vnio_openfd(int fd, vniodesc_t *vniop)
2273 {
2274 proc_t p = current_proc();
2275 struct fileproc *fp = NULL;
2276 vniodesc_t vnio;
2277 vnode_t vp;
2278 int error;
2279 bool need_drop = false;
2280
2281 vnio = kalloc_type(struct vniodesc, Z_WAITOK);
2282
2283 error = fp_getfvp(p, fd, &fp, &vp);
2284 if (error) {
2285 goto out;
2286 }
2287 need_drop = true;
2288
2289 if ((fp->fp_glob->fg_flag & (FREAD | FWRITE)) == 0) {
2290 error = EBADF;
2291 goto out;
2292 }
2293
2294 if (vnode_isswap(vp)) {
2295 error = EPERM;
2296 goto out;
2297 }
2298
2299 if (vp->v_type != VREG) {
2300 error = EFTYPE;
2301 goto out;
2302 }
2303
2304 error = vnode_getwithref(vp);
2305 if (error) {
2306 goto out;
2307 }
2308
2309 vnio->vnio_vnode = vp;
2310 vnio->vnio_fflags = fp->fp_glob->fg_flag;
2311
2312 (void)fp_drop(p, fd, fp, 0);
2313 need_drop = false;
2314
2315 error = vnode_ref_ext(vp, vnio->vnio_fflags, 0);
2316 if (error == 0) {
2317 *vniop = vnio;
2318 vnio = NULL;
2319 }
2320
2321 vnode_put(vp);
2322
2323 out:
2324 if (need_drop) {
2325 fp_drop(p, fd, fp, 0);
2326 }
2327 if (vnio != NULL) {
2328 kfree_type(struct vniodesc, vnio);
2329 }
2330 return error;
2331 }
2332
2333 errno_t
vnio_close(vniodesc_t vnio)2334 vnio_close(vniodesc_t vnio)
2335 {
2336 int error;
2337
2338 /*
2339 * The vniodesc is always destroyed, because the close
2340 * always "succeeds". We just return whatever error
2341 * might have been encountered while doing so.
2342 */
2343
2344 error = vnode_getwithref(vnio->vnio_vnode);
2345 if (error == 0) {
2346 error = vnode_close(vnio->vnio_vnode, vnio->vnio_fflags, NULL);
2347 }
2348
2349 kfree_type(struct vniodesc, vnio);
2350
2351 return error;
2352 }
2353
2354 errno_t
vnio_read(vniodesc_t vnio,uio_t uio)2355 vnio_read(vniodesc_t vnio, uio_t uio)
2356 {
2357 vnode_t vp = vnio->vnio_vnode;
2358 user_ssize_t read_len;
2359 int error;
2360
2361 read_len = uio_resid(uio);
2362 if (read_len < 0 || read_len > INT_MAX) {
2363 return EINVAL;
2364 }
2365
2366 error = vnode_getwithref(vp);
2367 if (error == 0) {
2368 error = vn_read_common(vp, uio, vnio->vnio_fflags,
2369 vfs_context_current());
2370 vnode_put(vp);
2371 }
2372
2373 return error;
2374 }
2375
2376 vnode_t
vnio_vnode(vniodesc_t vnio)2377 vnio_vnode(vniodesc_t vnio)
2378 {
2379 return vnio->vnio_vnode;
2380 }
2381
2382 int
vnode_isauthfs(vnode_t vp)2383 vnode_isauthfs(vnode_t vp)
2384 {
2385 fsioc_auth_fs_t afs = { .authvp = NULL };
2386 int error;
2387
2388 error = VNOP_IOCTL(vp, FSIOC_AUTH_FS, (caddr_t)&afs, 0,
2389 vfs_context_current());
2390
2391 return error == 0 ? 1 : 0;
2392 }
2393