1 /*
2 * Copyright (c) 2000-2020 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28 /* Copyright (c) 1995 NeXT Computer, Inc. All Rights Reserved */
29 /*
30 * Copyright (c) 1982, 1986, 1989, 1993
31 * The Regents of the University of California. All rights reserved.
32 * (c) UNIX System Laboratories, Inc.
33 * All or some portions of this file are derived from material licensed
34 * to the University of California by American Telephone and Telegraph
35 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
36 * the permission of UNIX System Laboratories, Inc.
37 *
38 * Redistribution and use in source and binary forms, with or without
39 * modification, are permitted provided that the following conditions
40 * are met:
41 * 1. Redistributions of source code must retain the above copyright
42 * notice, this list of conditions and the following disclaimer.
43 * 2. Redistributions in binary form must reproduce the above copyright
44 * notice, this list of conditions and the following disclaimer in the
45 * documentation and/or other materials provided with the distribution.
46 * 3. All advertising materials mentioning features or use of this software
47 * must display the following acknowledgement:
48 * This product includes software developed by the University of
49 * California, Berkeley and its contributors.
50 * 4. Neither the name of the University nor the names of its contributors
51 * may be used to endorse or promote products derived from this software
52 * without specific prior written permission.
53 *
54 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
55 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
56 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
57 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
58 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
59 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
60 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
61 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
62 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
63 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
64 * SUCH DAMAGE.
65 *
66 * @(#)vfs_vnops.c 8.14 (Berkeley) 6/15/95
67 *
68 */
69 /*
70 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
71 * support for mandatory and extensible security protections. This notice
72 * is included in support of clause 2.2 (b) of the Apple Public License,
73 * Version 2.0.
74 */
75
76 #include <sys/param.h>
77 #include <sys/types.h>
78 #include <sys/systm.h>
79 #include <sys/kernel.h>
80 #include <sys/file_internal.h>
81 #include <sys/stat.h>
82 #include <sys/proc_internal.h>
83 #include <sys/kauth.h>
84 #include <sys/mount_internal.h>
85 #include <sys/namei.h>
86 #include <sys/vnode_internal.h>
87 #include <sys/ioctl.h>
88 #include <sys/fsctl.h>
89 #include <sys/tty.h>
90 /* Temporary workaround for ubc.h until <rdar://4714366 is resolved */
91 #define ubc_setcred ubc_setcred_deprecated
92 #include <sys/ubc.h>
93 #undef ubc_setcred
94 int ubc_setcred(struct vnode *, struct proc *);
95 #include <sys/conf.h>
96 #include <sys/disk.h>
97 #include <sys/fsevents.h>
98 #include <sys/kdebug.h>
99 #include <sys/xattr.h>
100 #include <sys/ubc_internal.h>
101 #include <sys/uio_internal.h>
102 #include <sys/resourcevar.h>
103 #include <sys/signalvar.h>
104
105 #include <vm/vm_kern.h>
106 #include <vm/vm_map.h>
107
108 #include <miscfs/specfs/specdev.h>
109 #include <miscfs/fifofs/fifo.h>
110
111 #if CONFIG_MACF
112 #include <security/mac_framework.h>
113 #endif
114
115 #include <IOKit/IOBSD.h>
116 #include <libkern/section_keywords.h>
117
118 static int vn_closefile(struct fileglob *fp, vfs_context_t ctx);
119 static int vn_ioctl(struct fileproc *fp, u_long com, caddr_t data,
120 vfs_context_t ctx);
121 static int vn_read(struct fileproc *fp, struct uio *uio, int flags,
122 vfs_context_t ctx);
123 static int vn_write(struct fileproc *fp, struct uio *uio, int flags,
124 vfs_context_t ctx);
125 static int vn_select( struct fileproc *fp, int which, void * wql,
126 vfs_context_t ctx);
127 static int vn_kqfilter(struct fileproc *fp, struct knote *kn,
128 struct kevent_qos_s *kev);
129 static void filt_vndetach(struct knote *kn);
130 static int filt_vnode(struct knote *kn, long hint);
131 static int filt_vnode_common(struct knote *kn, struct kevent_qos_s *kev,
132 vnode_t vp, long hint);
133 static int vn_open_auth_finish(vnode_t vp, int fmode, vfs_context_t ctx);
134
135 const struct fileops vnops = {
136 .fo_type = DTYPE_VNODE,
137 .fo_read = vn_read,
138 .fo_write = vn_write,
139 .fo_ioctl = vn_ioctl,
140 .fo_select = vn_select,
141 .fo_close = vn_closefile,
142 .fo_drain = fo_no_drain,
143 .fo_kqfilter = vn_kqfilter,
144 };
145
146 static int filt_vntouch(struct knote *kn, struct kevent_qos_s *kev);
147 static int filt_vnprocess(struct knote *kn, struct kevent_qos_s*kev);
148
149 SECURITY_READ_ONLY_EARLY(struct filterops) vnode_filtops = {
150 .f_isfd = 1,
151 .f_attach = NULL,
152 .f_detach = filt_vndetach,
153 .f_event = filt_vnode,
154 .f_touch = filt_vntouch,
155 .f_process = filt_vnprocess,
156 };
157
158 /*
159 * Common code for vnode open operations.
160 * Check permissions, and call the VNOP_OPEN or VNOP_CREATE routine.
161 *
162 * XXX the profusion of interfaces here is probably a bad thing.
163 */
164 int
vn_open(struct nameidata * ndp,int fmode,int cmode)165 vn_open(struct nameidata *ndp, int fmode, int cmode)
166 {
167 return vn_open_modflags(ndp, &fmode, cmode);
168 }
169
170 int
vn_open_modflags(struct nameidata * ndp,int * fmodep,int cmode)171 vn_open_modflags(struct nameidata *ndp, int *fmodep, int cmode)
172 {
173 int error;
174 struct vnode_attr *vap;
175
176 vap = kalloc_type(struct vnode_attr, Z_WAITOK);
177
178 VATTR_INIT(vap);
179 VATTR_SET(vap, va_mode, (mode_t)cmode);
180
181 error = vn_open_auth(ndp, fmodep, vap, NULLVP);
182
183 kfree_type(struct vnode_attr, vap);
184
185 return error;
186 }
187
188 static int
vn_open_auth_finish(vnode_t vp,int fmode,vfs_context_t ctx)189 vn_open_auth_finish(vnode_t vp, int fmode, vfs_context_t ctx)
190 {
191 int error;
192
193 if ((error = vnode_ref_ext(vp, fmode, 0)) != 0) {
194 goto bad;
195 }
196
197 /* Call out to allow 3rd party notification of open.
198 * Ignore result of kauth_authorize_fileop call.
199 */
200 #if CONFIG_MACF
201 mac_vnode_notify_open(ctx, vp, fmode);
202 #endif
203 kauth_authorize_fileop(vfs_context_ucred(ctx), KAUTH_FILEOP_OPEN,
204 (uintptr_t)vp, 0);
205
206 return 0;
207
208 bad:
209 return error;
210 }
211
212 /*
213 * May do nameidone() to allow safely adding an FSEvent. Cue off of ni_dvp to
214 * determine whether that has happened.
215 */
216 static int
vn_open_auth_do_create(struct nameidata * ndp,struct vnode_attr * vap,int fmode,boolean_t * did_create,boolean_t * did_open,vfs_context_t ctx)217 vn_open_auth_do_create(struct nameidata *ndp, struct vnode_attr *vap, int fmode, boolean_t *did_create, boolean_t *did_open, vfs_context_t ctx)
218 {
219 uint32_t status = 0;
220 vnode_t dvp = ndp->ni_dvp;
221 int batched;
222 int error;
223 vnode_t vp;
224
225 batched = vnode_compound_open_available(ndp->ni_dvp);
226 *did_open = FALSE;
227
228 VATTR_SET(vap, va_type, VREG);
229 if (fmode & O_EXCL) {
230 vap->va_vaflags |= VA_EXCLUSIVE;
231 }
232
233 #if NAMEDRSRCFORK
234 if (ndp->ni_cnd.cn_flags & CN_WANTSRSRCFORK) {
235 if ((error = vn_authorize_create(dvp, &ndp->ni_cnd, vap, ctx, NULL)) != 0) {
236 goto out;
237 }
238 if ((error = vnode_makenamedstream(dvp, &ndp->ni_vp, XATTR_RESOURCEFORK_NAME, 0, ctx)) != 0) {
239 goto out;
240 }
241 *did_create = TRUE;
242 } else {
243 #endif
244 if (!batched) {
245 if ((error = vn_authorize_create(dvp, &ndp->ni_cnd, vap, ctx, NULL)) != 0) {
246 goto out;
247 }
248 }
249
250 error = vn_create(dvp, &ndp->ni_vp, ndp, vap, VN_CREATE_DOOPEN, fmode, &status, ctx);
251 if (error != 0) {
252 if (batched) {
253 *did_create = (status & COMPOUND_OPEN_STATUS_DID_CREATE) ? TRUE : FALSE;
254 } else {
255 *did_create = FALSE;
256 }
257
258 if (error == EKEEPLOOKING) {
259 if (*did_create) {
260 panic("EKEEPLOOKING, but we did a create?");
261 }
262 if (!batched) {
263 panic("EKEEPLOOKING from filesystem that doesn't support compound vnops?");
264 }
265 if ((ndp->ni_flag & NAMEI_CONTLOOKUP) == 0) {
266 panic("EKEEPLOOKING, but continue flag not set?");
267 }
268
269 /*
270 * Do NOT drop the dvp: we need everything to continue the lookup.
271 */
272 return error;
273 }
274 } else {
275 if (batched) {
276 *did_create = (status & COMPOUND_OPEN_STATUS_DID_CREATE) ? 1 : 0;
277 *did_open = TRUE;
278 } else {
279 *did_create = TRUE;
280 }
281 }
282 #if NAMEDRSRCFORK
283 }
284 #endif
285
286 vp = ndp->ni_vp;
287
288 if (*did_create) {
289 int update_flags = 0;
290
291 // Make sure the name & parent pointers are hooked up
292 if (vp->v_name == NULL) {
293 update_flags |= VNODE_UPDATE_NAME;
294 }
295 if (vp->v_parent == NULLVP) {
296 update_flags |= VNODE_UPDATE_PARENT;
297 }
298
299 if (update_flags) {
300 vnode_update_identity(vp, dvp, ndp->ni_cnd.cn_nameptr, ndp->ni_cnd.cn_namelen, ndp->ni_cnd.cn_hash, update_flags);
301 }
302
303 vnode_put(dvp);
304 ndp->ni_dvp = NULLVP;
305
306 #if CONFIG_FSE
307 if (need_fsevent(FSE_CREATE_FILE, vp)) {
308 add_fsevent(FSE_CREATE_FILE, ctx,
309 FSE_ARG_VNODE, vp,
310 FSE_ARG_DONE);
311 }
312 #endif
313 }
314 out:
315 if (ndp->ni_dvp != NULLVP) {
316 vnode_put(dvp);
317 ndp->ni_dvp = NULLVP;
318 }
319
320 return error;
321 }
322
323 /*
324 * This is the number of times we'll loop in vn_open_auth without explicitly
325 * yielding the CPU when we determine we have to retry.
326 */
327 #define RETRY_NO_YIELD_COUNT 5
328
329 /*
330 * Open a file with authorization, updating the contents of the structures
331 * pointed to by ndp, fmodep, and vap as necessary to perform the requested
332 * operation. This function is used for both opens of existing files, and
333 * creation of new files.
334 *
335 * Parameters: ndp The nami data pointer describing the
336 * file
337 * fmodep A pointer to an int containg the mode
338 * information to be used for the open
339 * vap A pointer to the vnode attribute
340 * descriptor to be used for the open
341 * authvp If non-null and VA_DP_AUTHENTICATE is set in vap,
342 * have a supporting filesystem verify that the file
343 * to be opened is on the same volume as authvp and
344 * that authvp is on an authenticated volume
345 *
346 * Indirect: * Contents of the data structures pointed
347 * to by the parameters are modified as
348 * necessary to the requested operation.
349 *
350 * Returns: 0 Success
351 * !0 errno value
352 *
353 * Notes: The kauth_filesec_t in 'vap', if any, is in host byte order.
354 *
355 * The contents of '*ndp' will be modified, based on the other
356 * arguments to this function, and to return file and directory
357 * data necessary to satisfy the requested operation.
358 *
359 * If the file does not exist and we are creating it, then the
360 * O_TRUNC flag will be cleared in '*fmodep' to indicate to the
361 * caller that the file was not truncated.
362 *
363 * If the file exists and the O_EXCL flag was not specified, then
364 * the O_CREAT flag will be cleared in '*fmodep' to indicate to
365 * the caller that the existing file was merely opened rather
366 * than created.
367 *
368 * The contents of '*vap' will be modified as necessary to
369 * complete the operation, including setting of supported
370 * attribute, clearing of fields containing unsupported attributes
371 * in the request, if the request proceeds without them, etc..
372 *
373 * XXX: This function is too complicated in actings on its arguments
374 *
375 * XXX: We should enummerate the possible errno values here, and where
376 * in the code they originated.
377 */
378 int
vn_open_auth(struct nameidata * ndp,int * fmodep,struct vnode_attr * vap,vnode_t authvp)379 vn_open_auth(struct nameidata *ndp, int *fmodep, struct vnode_attr *vap, vnode_t authvp)
380 {
381 struct vnode *vp;
382 struct vnode *dvp;
383 vfs_context_t ctx = ndp->ni_cnd.cn_context;
384 int error;
385 int fmode;
386 uint32_t origcnflags;
387 boolean_t did_create;
388 boolean_t did_open;
389 boolean_t need_vnop_open;
390 boolean_t batched;
391 boolean_t ref_failed;
392 int nretries = 0;
393
394 again:
395 vp = NULL;
396 dvp = NULL;
397 batched = FALSE;
398 did_create = FALSE;
399 need_vnop_open = TRUE;
400 ref_failed = FALSE;
401 fmode = *fmodep;
402 origcnflags = ndp->ni_cnd.cn_flags;
403
404 if (VATTR_IS_ACTIVE(vap, va_dataprotect_flags)) {
405 if ((authvp != NULLVP)
406 && !ISSET(vap->va_dataprotect_flags, VA_DP_AUTHENTICATE)) {
407 return EINVAL;
408 }
409 // If raw encrypted mode is requested, handle that here
410 if (ISSET(vap->va_dataprotect_flags, VA_DP_RAWENCRYPTED)) {
411 fmode |= FENCRYPTED;
412 }
413 }
414
415 if ((fmode & O_NOFOLLOW_ANY) && (fmode & (O_SYMLINK | O_NOFOLLOW))) {
416 error = EINVAL;
417 goto out;
418 }
419
420 /*
421 * O_CREAT
422 */
423 if (fmode & O_CREAT) {
424 if ((fmode & O_DIRECTORY)) {
425 error = EINVAL;
426 goto out;
427 }
428 ndp->ni_cnd.cn_nameiop = CREATE;
429 #if CONFIG_TRIGGERS
430 ndp->ni_op = OP_LINK;
431 #endif
432 /* Inherit USEDVP, vnode_open() supported flags only */
433 ndp->ni_cnd.cn_flags &= (USEDVP | NOCROSSMOUNT);
434 ndp->ni_cnd.cn_flags |= LOCKPARENT | LOCKLEAF | AUDITVNPATH1;
435 ndp->ni_flag = NAMEI_COMPOUNDOPEN;
436 #if NAMEDRSRCFORK
437 /* open calls are allowed for resource forks. */
438 ndp->ni_cnd.cn_flags |= CN_ALLOWRSRCFORK;
439 #endif
440 if ((fmode & O_EXCL) == 0 && (fmode & O_NOFOLLOW) == 0 && (origcnflags & FOLLOW) != 0) {
441 ndp->ni_cnd.cn_flags |= FOLLOW;
442 }
443 if (fmode & O_NOFOLLOW_ANY) {
444 /* will return ELOOP on the first symlink to be hit */
445 ndp->ni_flag |= NAMEI_NOFOLLOW_ANY;
446 }
447
448 continue_create_lookup:
449 if ((error = namei(ndp))) {
450 goto out;
451 }
452
453 dvp = ndp->ni_dvp;
454 vp = ndp->ni_vp;
455
456 batched = vnode_compound_open_available(dvp);
457
458 /* not found, create */
459 if (vp == NULL) {
460 /* must have attributes for a new file */
461 if (vap == NULL) {
462 vnode_put(dvp);
463 error = EINVAL;
464 goto out;
465 }
466 /*
467 * Attempt a create. For a system supporting compound VNOPs, we may
468 * find an existing file or create one; in either case, we will already
469 * have the file open and no VNOP_OPEN() will be needed.
470 */
471 error = vn_open_auth_do_create(ndp, vap, fmode, &did_create, &did_open, ctx);
472
473 dvp = ndp->ni_dvp;
474 vp = ndp->ni_vp;
475
476 /*
477 * Detected a node that the filesystem couldn't handle. Don't call
478 * nameidone() yet, because we need that path buffer.
479 */
480 if (error == EKEEPLOOKING) {
481 if (!batched) {
482 panic("EKEEPLOOKING from a filesystem that doesn't support compound VNOPs?");
483 }
484 goto continue_create_lookup;
485 }
486
487 nameidone(ndp);
488 if (dvp) {
489 panic("Shouldn't have a dvp here.");
490 }
491
492 if (error) {
493 /*
494 * Check for a create race.
495 */
496 if ((error == EEXIST) && !(fmode & O_EXCL)) {
497 if (vp) {
498 vnode_put(vp);
499 }
500 goto again;
501 }
502 goto bad;
503 }
504
505 need_vnop_open = !did_open;
506 } else {
507 if (fmode & O_EXCL) {
508 error = EEXIST;
509 }
510
511 /*
512 * We have a vnode. Use compound open if available
513 * or else fall through to "traditional" path. Note: can't
514 * do a compound open for root, because the parent belongs
515 * to a different FS.
516 */
517 if (error == 0 && batched && (vnode_mount(dvp) == vnode_mount(vp))) {
518 error = VNOP_COMPOUND_OPEN(dvp, &ndp->ni_vp, ndp, 0, fmode, NULL, NULL, ctx);
519
520 if (error == 0) {
521 vp = ndp->ni_vp;
522 need_vnop_open = FALSE;
523 } else if (error == EKEEPLOOKING) {
524 if ((ndp->ni_flag & NAMEI_CONTLOOKUP) == 0) {
525 panic("EKEEPLOOKING, but continue flag not set?");
526 }
527 goto continue_create_lookup;
528 }
529 }
530 nameidone(ndp);
531 vnode_put(dvp);
532 ndp->ni_dvp = NULLVP;
533
534 if (error) {
535 goto bad;
536 }
537
538 fmode &= ~O_CREAT;
539
540 /* Fall through */
541 }
542 } else {
543 /*
544 * Not O_CREAT
545 */
546 ndp->ni_cnd.cn_nameiop = LOOKUP;
547 /* Inherit USEDVP, vnode_open() supported flags only */
548 ndp->ni_cnd.cn_flags &= (USEDVP | NOCROSSMOUNT);
549 ndp->ni_cnd.cn_flags |= FOLLOW | LOCKLEAF | AUDITVNPATH1 | WANTPARENT;
550 #if NAMEDRSRCFORK
551 /* open calls are allowed for resource forks. */
552 ndp->ni_cnd.cn_flags |= CN_ALLOWRSRCFORK;
553 #endif
554 if (fmode & FENCRYPTED) {
555 ndp->ni_cnd.cn_flags |= CN_RAW_ENCRYPTED | CN_SKIPNAMECACHE;
556 }
557 ndp->ni_flag = NAMEI_COMPOUNDOPEN;
558
559 /* preserve NOFOLLOW from vnode_open() */
560 if (fmode & O_NOFOLLOW || fmode & O_SYMLINK || (origcnflags & FOLLOW) == 0) {
561 ndp->ni_cnd.cn_flags &= ~FOLLOW;
562 }
563 if (fmode & O_NOFOLLOW_ANY) {
564 /* will return ELOOP on the first symlink to be hit */
565 ndp->ni_flag |= NAMEI_NOFOLLOW_ANY;
566 }
567
568 /* Do a lookup, possibly going directly to filesystem for compound operation */
569 do {
570 if ((error = namei(ndp))) {
571 goto out;
572 }
573 vp = ndp->ni_vp;
574 dvp = ndp->ni_dvp;
575
576 /* Check for batched lookup-open */
577 batched = vnode_compound_open_available(dvp);
578 if (batched && ((vp == NULLVP) || (vnode_mount(dvp) == vnode_mount(vp)))) {
579 error = VNOP_COMPOUND_OPEN(dvp, &ndp->ni_vp, ndp, 0, fmode, NULL, NULL, ctx);
580 vp = ndp->ni_vp;
581 if (error == 0) {
582 need_vnop_open = FALSE;
583 } else if (error == EKEEPLOOKING) {
584 if ((ndp->ni_flag & NAMEI_CONTLOOKUP) == 0) {
585 panic("EKEEPLOOKING, but continue flag not set?");
586 }
587 } else if ((fmode & (FREAD | FWRITE | FEXEC)) == FEXEC) {
588 /*
589 * Some file systems fail in vnop_open call with absense of
590 * both FREAD and FWRITE access modes. Retry the vnop_open
591 * call again with FREAD access mode added.
592 */
593 error = VNOP_COMPOUND_OPEN(dvp, &ndp->ni_vp, ndp, 0,
594 fmode | FREAD, NULL, NULL, ctx);
595 if (error == 0) {
596 vp = ndp->ni_vp;
597 need_vnop_open = FALSE;
598 }
599 }
600 }
601 } while (error == EKEEPLOOKING);
602
603 nameidone(ndp);
604 vnode_put(dvp);
605 ndp->ni_dvp = NULLVP;
606
607 if (error) {
608 goto bad;
609 }
610 }
611
612 /*
613 * By this point, nameidone() is called, dvp iocount is dropped,
614 * and dvp pointer is cleared.
615 */
616 if (ndp->ni_dvp != NULLVP) {
617 panic("Haven't cleaned up adequately in vn_open_auth()");
618 }
619
620 /*
621 * Expect to use this code for filesystems without compound VNOPs, for the root
622 * of a filesystem, which can't be "looked up" in the sense of VNOP_LOOKUP(),
623 * and for shadow files, which do not live on the same filesystems as their "parents."
624 */
625 if (need_vnop_open) {
626 if (batched && !vnode_isvroot(vp) && !vnode_isnamedstream(vp)) {
627 panic("Why am I trying to use VNOP_OPEN() on anything other than the root or a named stream?");
628 }
629
630 if (!did_create) {
631 error = vn_authorize_open_existing(vp, &ndp->ni_cnd, fmode, ctx, NULL);
632 if (error) {
633 goto bad;
634 }
635 }
636
637 if (VATTR_IS_ACTIVE(vap, va_dataprotect_flags)) {
638 if (ISSET(vap->va_dataprotect_flags, VA_DP_RAWUNENCRYPTED)) {
639 /* Don't allow unencrypted io request from user space unless entitled */
640 boolean_t entitled = FALSE;
641 #if !SECURE_KERNEL
642 entitled = IOCurrentTaskHasEntitlement("com.apple.private.security.file-unencrypt-access");
643 #endif /* SECURE_KERNEL */
644 if (!entitled) {
645 error = EPERM;
646 goto bad;
647 }
648 fmode |= FUNENCRYPTED;
649 }
650
651 if (ISSET(vap->va_dataprotect_flags, VA_DP_AUTHENTICATE)) {
652 fsioc_auth_fs_t afs = { .authvp = authvp };
653
654 error = VNOP_IOCTL(vp, FSIOC_AUTH_FS, (caddr_t)&afs, 0, ctx);
655 if (error) {
656 goto bad;
657 }
658 }
659 }
660
661 error = VNOP_OPEN(vp, fmode, ctx);
662 if (error) {
663 /*
664 * Some file systems fail in vnop_open call with absense of both
665 * FREAD and FWRITE access modes. Retry the vnop_open call again
666 * with FREAD access mode added.
667 */
668 if ((fmode & (FREAD | FWRITE | FEXEC)) == FEXEC) {
669 error = VNOP_OPEN(vp, fmode | FREAD, ctx);
670 }
671 if (error) {
672 goto bad;
673 }
674 }
675 need_vnop_open = FALSE;
676 }
677
678 // if the vnode is tagged VOPENEVT and the current process
679 // has the P_CHECKOPENEVT flag set, then we or in the O_EVTONLY
680 // flag to the open mode so that this open won't count against
681 // the vnode when carbon delete() does a vnode_isinuse() to see
682 // if a file is currently in use. this allows spotlight
683 // importers to not interfere with carbon apps that depend on
684 // the no-delete-if-busy semantics of carbon delete().
685 //
686 if (!did_create && (vp->v_flag & VOPENEVT) && (current_proc()->p_flag & P_CHECKOPENEVT)) {
687 fmode |= O_EVTONLY;
688 }
689
690 /*
691 * Grab reference, etc.
692 */
693 error = vn_open_auth_finish(vp, fmode, ctx);
694 if (error) {
695 ref_failed = TRUE;
696 goto bad;
697 }
698
699 /* Compound VNOP open is responsible for doing the truncate */
700 if (batched || did_create) {
701 fmode &= ~O_TRUNC;
702 }
703
704 *fmodep = fmode;
705 return 0;
706
707 bad:
708 /* Opened either explicitly or by a batched create */
709 if (!need_vnop_open) {
710 VNOP_CLOSE(vp, fmode, ctx);
711 }
712
713 ndp->ni_vp = NULL;
714 if (vp) {
715 #if NAMEDRSRCFORK
716 /* Aggressively recycle shadow files if we error'd out during open() */
717 if ((vnode_isnamedstream(vp)) &&
718 (vp->v_parent != NULLVP) &&
719 (vnode_isshadow(vp))) {
720 vnode_recycle(vp);
721 }
722 #endif
723 vnode_put(vp);
724 /*
725 * Check for a race against unlink. We had a vnode
726 * but according to vnode_authorize or VNOP_OPEN it
727 * no longer exists.
728 *
729 * EREDRIVEOPEN: means that we were hit by the tty allocation race.
730 */
731 if (((error == ENOENT) && (*fmodep & O_CREAT)) || (error == EREDRIVEOPEN) || ref_failed) {
732 /*
733 * We'll retry here but it may be possible that we get
734 * into a retry "spin" inside the kernel and not allow
735 * threads, which need to run in order for the retry
736 * loop to end, to run. An example is an open of a
737 * terminal which is getting revoked and we spin here
738 * without yielding becasue namei and VNOP_OPEN are
739 * successful but vnode_ref fails. The revoke needs
740 * threads with an iocount to run but if spin here we
741 * may possibly be blcoking other threads from running.
742 *
743 * We start yielding the CPU after some number of
744 * retries for increasing durations. Note that this is
745 * still a loop without an exit condition.
746 */
747 nretries += 1;
748 if (nretries > RETRY_NO_YIELD_COUNT) {
749 /* Every hz/100 secs is 10 msecs ... */
750 tsleep(&nretries, PVFS, "vn_open_auth_retry",
751 MIN((nretries * (hz / 100)), hz));
752 }
753 goto again;
754 }
755 }
756
757 out:
758 return error;
759 }
760
761 #if vn_access_DEPRECATED
762 /*
763 * Authorize an action against a vnode. This has been the canonical way to
764 * ensure that the credential/process/etc. referenced by a vfs_context
765 * is granted the rights called out in 'mode' against the vnode 'vp'.
766 *
767 * Unfortunately, the use of VREAD/VWRITE/VEXEC makes it very difficult
768 * to add support for more rights. As such, this interface will be deprecated
769 * and callers will use vnode_authorize instead.
770 */
771 int
vn_access(vnode_t vp,int mode,vfs_context_t context)772 vn_access(vnode_t vp, int mode, vfs_context_t context)
773 {
774 kauth_action_t action;
775
776 action = 0;
777 if (mode & VREAD) {
778 action |= KAUTH_VNODE_READ_DATA;
779 }
780 if (mode & VWRITE) {
781 action |= KAUTH_VNODE_WRITE_DATA;
782 }
783 if (mode & VEXEC) {
784 action |= KAUTH_VNODE_EXECUTE;
785 }
786
787 return vnode_authorize(vp, NULL, action, context);
788 }
789 #endif /* vn_access_DEPRECATED */
790
791 /*
792 * Vnode close call
793 */
794 int
vn_close(struct vnode * vp,int flags,vfs_context_t ctx)795 vn_close(struct vnode *vp, int flags, vfs_context_t ctx)
796 {
797 int error;
798 int flusherror = 0;
799
800 #if NAMEDRSRCFORK
801 /* Sync data from resource fork shadow file if needed. */
802 if ((vp->v_flag & VISNAMEDSTREAM) &&
803 (vp->v_parent != NULLVP) &&
804 vnode_isshadow(vp)) {
805 if (flags & FWASWRITTEN) {
806 flusherror = vnode_flushnamedstream(vp->v_parent, vp, ctx);
807 }
808 }
809 #endif
810 /*
811 * If vnode @vp belongs to a chardev or a blkdev then it is handled
812 * specially. We first drop its user reference count @vp->v_usecount
813 * before calling VNOP_CLOSE(). This was done historically to ensure
814 * that the last close of a special device vnode performed some
815 * conditional cleanups. Now we still need to drop this reference here
816 * to ensure that devfsspec_close() can check if the vnode is still in
817 * use.
818 */
819 if (vnode_isspec(vp)) {
820 (void)vnode_rele_ext(vp, flags, 0);
821 }
822
823 /*
824 * On HFS, we flush when the last writer closes. We do this
825 * because resource fork vnodes hold a reference on data fork
826 * vnodes and that will prevent them from getting VNOP_INACTIVE
827 * which will delay when we flush cached data. In future, we
828 * might find it beneficial to do this for all file systems.
829 * Note that it's OK to access v_writecount without the lock
830 * in this context.
831 */
832 if (vp->v_tag == VT_HFS && (flags & FWRITE) && vp->v_writecount == 1) {
833 VNOP_FSYNC(vp, MNT_NOWAIT, ctx);
834 }
835
836 error = VNOP_CLOSE(vp, flags, ctx);
837
838 #if CONFIG_FSE
839 if (flags & FWASWRITTEN) {
840 if (need_fsevent(FSE_CONTENT_MODIFIED, vp)) {
841 add_fsevent(FSE_CONTENT_MODIFIED, ctx,
842 FSE_ARG_VNODE, vp,
843 FSE_ARG_DONE);
844 }
845 }
846 #endif
847
848 if (!vnode_isspec(vp)) {
849 (void)vnode_rele_ext(vp, flags, 0);
850 }
851
852 if (flusherror) {
853 error = flusherror;
854 }
855 return error;
856 }
857
858 static int
vn_read_swapfile(struct vnode * vp,uio_t uio)859 vn_read_swapfile(
860 struct vnode *vp,
861 uio_t uio)
862 {
863 int error;
864 off_t swap_count, this_count;
865 off_t file_end, read_end;
866 off_t prev_resid;
867 char *my_swap_page;
868
869 /*
870 * Reading from a swap file will get you zeroes.
871 */
872
873 my_swap_page = NULL;
874 error = 0;
875 swap_count = uio_resid(uio);
876
877 file_end = ubc_getsize(vp);
878 read_end = uio->uio_offset + uio_resid(uio);
879 if (uio->uio_offset >= file_end) {
880 /* uio starts after end of file: nothing to read */
881 swap_count = 0;
882 } else if (read_end > file_end) {
883 /* uio extends beyond end of file: stop before that */
884 swap_count -= (read_end - file_end);
885 }
886
887 while (swap_count > 0) {
888 if (my_swap_page == NULL) {
889 my_swap_page = kalloc_data(PAGE_SIZE, Z_WAITOK | Z_ZERO);
890 /* add an end-of-line to keep line counters happy */
891 my_swap_page[PAGE_SIZE - 1] = '\n';
892 }
893 this_count = swap_count;
894 if (this_count > PAGE_SIZE) {
895 this_count = PAGE_SIZE;
896 }
897
898 prev_resid = uio_resid(uio);
899 error = uiomove((caddr_t) my_swap_page,
900 (int)this_count,
901 uio);
902 if (error) {
903 break;
904 }
905 swap_count -= (prev_resid - uio_resid(uio));
906 }
907 kfree_data(my_swap_page, PAGE_SIZE);
908
909 return error;
910 }
911 /*
912 * Package up an I/O request on a vnode into a uio and do it.
913 */
914 int
vn_rdwr(enum uio_rw rw,struct vnode * vp,caddr_t base,int len,off_t offset,enum uio_seg segflg,int ioflg,kauth_cred_t cred,int * aresid,proc_t p)915 vn_rdwr(
916 enum uio_rw rw,
917 struct vnode *vp,
918 caddr_t base,
919 int len,
920 off_t offset,
921 enum uio_seg segflg,
922 int ioflg,
923 kauth_cred_t cred,
924 int *aresid,
925 proc_t p)
926 {
927 int64_t resid;
928 int result;
929
930 if (len < 0) {
931 return EINVAL;
932 }
933
934 result = vn_rdwr_64(rw,
935 vp,
936 (uint64_t)(uintptr_t)base,
937 (int64_t)len,
938 offset,
939 segflg,
940 ioflg,
941 cred,
942 &resid,
943 p);
944
945 /* "resid" should be bounded above by "len," which is an int */
946 if (aresid != NULL) {
947 *aresid = (int)resid;
948 }
949
950 return result;
951 }
952
953
954 int
vn_rdwr_64(enum uio_rw rw,struct vnode * vp,uint64_t base,int64_t len,off_t offset,enum uio_seg segflg,int ioflg,kauth_cred_t cred,int64_t * aresid,proc_t p)955 vn_rdwr_64(
956 enum uio_rw rw,
957 struct vnode *vp,
958 uint64_t base,
959 int64_t len,
960 off_t offset,
961 enum uio_seg segflg,
962 int ioflg,
963 kauth_cred_t cred,
964 int64_t *aresid,
965 proc_t p)
966 {
967 uio_t auio;
968 int spacetype;
969 struct vfs_context context;
970 int error = 0;
971 uio_stackbuf_t uio_buf[UIO_SIZEOF(1)];
972
973 context.vc_thread = current_thread();
974 context.vc_ucred = cred;
975
976 if (UIO_SEG_IS_USER_SPACE(segflg)) {
977 spacetype = proc_is64bit(p) ? UIO_USERSPACE64 : UIO_USERSPACE32;
978 } else {
979 spacetype = UIO_SYSSPACE;
980 }
981
982 if (len < 0) {
983 return EINVAL;
984 }
985
986 auio = uio_createwithbuffer(1, offset, spacetype, rw,
987 &uio_buf[0], sizeof(uio_buf));
988 uio_addiov(auio, CAST_USER_ADDR_T(base), (user_size_t)len);
989
990 #if CONFIG_MACF
991 /* XXXMAC
992 * IO_NOAUTH should be re-examined.
993 * Likely that mediation should be performed in caller.
994 */
995 if ((ioflg & IO_NOAUTH) == 0) {
996 /* passed cred is fp->f_cred */
997 if (rw == UIO_READ) {
998 error = mac_vnode_check_read(&context, cred, vp);
999 } else {
1000 error = mac_vnode_check_write(&context, cred, vp);
1001 }
1002 }
1003 #endif
1004
1005 if (error == 0) {
1006 if (rw == UIO_READ) {
1007 if (vnode_isswap(vp) && ((ioflg & IO_SWAP_DISPATCH) == 0)) {
1008 error = vn_read_swapfile(vp, auio);
1009 } else {
1010 error = VNOP_READ(vp, auio, ioflg, &context);
1011 }
1012 } else {
1013 error = VNOP_WRITE(vp, auio, ioflg, &context);
1014 }
1015 }
1016
1017 if (aresid) {
1018 *aresid = uio_resid(auio);
1019 assert(*aresid <= len);
1020 } else if (uio_resid(auio) && error == 0) {
1021 error = EIO;
1022 }
1023 return error;
1024 }
1025
1026 void
vn_offset_lock(struct fileglob * fg)1027 vn_offset_lock(struct fileglob *fg)
1028 {
1029 lck_mtx_lock_spin(&fg->fg_lock);
1030 while (fg->fg_lflags & FG_OFF_LOCKED) {
1031 fg->fg_lflags |= FG_OFF_LOCKWANT;
1032 msleep(&fg->fg_lflags, &fg->fg_lock, PVFS | PSPIN,
1033 "fg_offset_lock_wait", 0);
1034 }
1035 fg->fg_lflags |= FG_OFF_LOCKED;
1036 lck_mtx_unlock(&fg->fg_lock);
1037 }
1038
1039 void
vn_offset_unlock(struct fileglob * fg)1040 vn_offset_unlock(struct fileglob *fg)
1041 {
1042 int lock_wanted = 0;
1043
1044 lck_mtx_lock_spin(&fg->fg_lock);
1045 if (fg->fg_lflags & FG_OFF_LOCKWANT) {
1046 lock_wanted = 1;
1047 }
1048 fg->fg_lflags &= ~(FG_OFF_LOCKED | FG_OFF_LOCKWANT);
1049 lck_mtx_unlock(&fg->fg_lock);
1050 if (lock_wanted) {
1051 wakeup(&fg->fg_lflags);
1052 }
1053 }
1054
1055 static int
vn_read_common(vnode_t vp,struct uio * uio,int fflag,vfs_context_t ctx)1056 vn_read_common(vnode_t vp, struct uio *uio, int fflag, vfs_context_t ctx)
1057 {
1058 int error;
1059 int ioflag;
1060 off_t read_offset;
1061 user_ssize_t read_len;
1062 user_ssize_t adjusted_read_len;
1063 user_ssize_t clippedsize;
1064
1065 /* Caller has already validated read_len. */
1066 read_len = uio_resid(uio);
1067 assert(read_len >= 0 && read_len <= INT_MAX);
1068
1069 adjusted_read_len = read_len;
1070 clippedsize = 0;
1071
1072 #if CONFIG_MACF
1073 error = mac_vnode_check_read(ctx, vfs_context_ucred(ctx), vp);
1074 if (error) {
1075 return error;
1076 }
1077 #endif
1078
1079 /* This signals to VNOP handlers that this read came from a file table read */
1080 ioflag = IO_SYSCALL_DISPATCH;
1081
1082 if (fflag & FNONBLOCK) {
1083 ioflag |= IO_NDELAY;
1084 }
1085 if ((fflag & FNOCACHE) || vnode_isnocache(vp)) {
1086 ioflag |= IO_NOCACHE;
1087 }
1088 if (fflag & FENCRYPTED) {
1089 ioflag |= IO_ENCRYPTED;
1090 }
1091 if (fflag & FUNENCRYPTED) {
1092 ioflag |= IO_SKIP_ENCRYPTION;
1093 }
1094 if (fflag & O_EVTONLY) {
1095 ioflag |= IO_EVTONLY;
1096 }
1097 if (fflag & FNORDAHEAD) {
1098 ioflag |= IO_RAOFF;
1099 }
1100
1101 read_offset = uio_offset(uio);
1102 /* POSIX allows negative offsets for character devices. */
1103 if ((read_offset < 0) && (vnode_vtype(vp) != VCHR)) {
1104 error = EINVAL;
1105 goto error_out;
1106 }
1107
1108 if (read_offset == INT64_MAX) {
1109 /* can't read any more */
1110 error = 0;
1111 goto error_out;
1112 }
1113
1114 /*
1115 * If offset + len will cause overflow, reduce the len to a value
1116 * (adjusted_read_len) where it won't
1117 */
1118 if ((read_offset >= 0) && (INT64_MAX - read_offset) < read_len) {
1119 /*
1120 * 0 read_offset INT64_MAX
1121 * |-----------------------------------------------|----------|~~~
1122 * <--read_len-->
1123 * <-adjusted->
1124 */
1125 adjusted_read_len = (user_ssize_t)(INT64_MAX - read_offset);
1126 }
1127
1128 if (adjusted_read_len < read_len) {
1129 uio_setresid(uio, adjusted_read_len);
1130 clippedsize = read_len - adjusted_read_len;
1131 }
1132
1133 if (vnode_isswap(vp) && !(IO_SKIP_ENCRYPTION & ioflag)) {
1134 /* special case for swap files */
1135 error = vn_read_swapfile(vp, uio);
1136 } else {
1137 error = VNOP_READ(vp, uio, ioflag, ctx);
1138 }
1139
1140 if (clippedsize) {
1141 uio_setresid(uio, (uio_resid(uio) + clippedsize));
1142 }
1143
1144 error_out:
1145 return error;
1146 }
1147
1148 /*
1149 * File table vnode read routine.
1150 */
1151 static int
vn_read(struct fileproc * fp,struct uio * uio,int flags,vfs_context_t ctx)1152 vn_read(struct fileproc *fp, struct uio *uio, int flags, vfs_context_t ctx)
1153 {
1154 vnode_t vp;
1155 user_ssize_t read_len;
1156 int error;
1157 bool offset_locked;
1158
1159 read_len = uio_resid(uio);
1160 if (read_len < 0 || read_len > INT_MAX) {
1161 return EINVAL;
1162 }
1163
1164 if ((flags & FOF_OFFSET) == 0) {
1165 vn_offset_lock(fp->fp_glob);
1166 offset_locked = true;
1167 } else {
1168 offset_locked = false;
1169 }
1170 vp = (struct vnode *)fp_get_data(fp);
1171 if ((error = vnode_getwithref(vp))) {
1172 if (offset_locked) {
1173 vn_offset_unlock(fp->fp_glob);
1174 }
1175 return error;
1176 }
1177
1178 if (offset_locked && (vnode_vtype(vp) != VREG || vnode_isswap(vp))) {
1179 vn_offset_unlock(fp->fp_glob);
1180 offset_locked = false;
1181 }
1182
1183 if ((flags & FOF_OFFSET) == 0) {
1184 uio_setoffset(uio, fp->fp_glob->fg_offset);
1185 }
1186
1187 error = vn_read_common(vp, uio, fp->fp_glob->fg_flag, ctx);
1188
1189 if ((flags & FOF_OFFSET) == 0) {
1190 fp->fp_glob->fg_offset += read_len - uio_resid(uio);
1191 }
1192
1193 if (offset_locked) {
1194 vn_offset_unlock(fp->fp_glob);
1195 offset_locked = false;
1196 }
1197
1198 vnode_put(vp);
1199 return error;
1200 }
1201
1202 /*
1203 * File table vnode write routine.
1204 */
1205 static int
vn_write(struct fileproc * fp,struct uio * uio,int flags,vfs_context_t ctx)1206 vn_write(struct fileproc *fp, struct uio *uio, int flags, vfs_context_t ctx)
1207 {
1208 struct vnode *vp;
1209 int error, ioflag;
1210 off_t write_offset;
1211 off_t write_end_offset;
1212 user_ssize_t write_len;
1213 user_ssize_t adjusted_write_len;
1214 user_ssize_t clippedsize;
1215 bool offset_locked;
1216 proc_t p = vfs_context_proc(ctx);
1217 rlim_t rlim_cur_fsize = p ? proc_limitgetcur(p, RLIMIT_FSIZE) : 0;
1218
1219 write_len = uio_resid(uio);
1220 if (write_len < 0 || write_len > INT_MAX) {
1221 return EINVAL;
1222 }
1223 adjusted_write_len = write_len;
1224 clippedsize = 0;
1225
1226 if ((flags & FOF_OFFSET) == 0) {
1227 vn_offset_lock(fp->fp_glob);
1228 offset_locked = true;
1229 } else {
1230 offset_locked = false;
1231 }
1232
1233 vp = (struct vnode *)fp_get_data(fp);
1234 if ((error = vnode_getwithref(vp))) {
1235 if (offset_locked) {
1236 vn_offset_unlock(fp->fp_glob);
1237 }
1238 return error;
1239 }
1240
1241 if (offset_locked && (vnode_vtype(vp) != VREG || vnode_isswap(vp))) {
1242 vn_offset_unlock(fp->fp_glob);
1243 offset_locked = false;
1244 }
1245
1246 #if CONFIG_MACF
1247 error = mac_vnode_check_write(ctx, vfs_context_ucred(ctx), vp);
1248 if (error) {
1249 (void)vnode_put(vp);
1250 if (offset_locked) {
1251 vn_offset_unlock(fp->fp_glob);
1252 }
1253 return error;
1254 }
1255 #endif
1256
1257 /*
1258 * IO_SYSCALL_DISPATCH signals to VNOP handlers that this write came from
1259 * a file table write
1260 */
1261 ioflag = (IO_UNIT | IO_SYSCALL_DISPATCH);
1262
1263 if (vp->v_type == VREG && (fp->fp_glob->fg_flag & O_APPEND)) {
1264 ioflag |= IO_APPEND;
1265 }
1266 if (fp->fp_glob->fg_flag & FNONBLOCK) {
1267 ioflag |= IO_NDELAY;
1268 }
1269 if ((fp->fp_glob->fg_flag & FNOCACHE) || vnode_isnocache(vp)) {
1270 ioflag |= IO_NOCACHE;
1271 }
1272 if (fp->fp_glob->fg_flag & FNODIRECT) {
1273 ioflag |= IO_NODIRECT;
1274 }
1275 if (fp->fp_glob->fg_flag & FSINGLE_WRITER) {
1276 ioflag |= IO_SINGLE_WRITER;
1277 }
1278 if (fp->fp_glob->fg_flag & O_EVTONLY) {
1279 ioflag |= IO_EVTONLY;
1280 }
1281
1282 /*
1283 * Treat synchronous mounts and O_FSYNC on the fd as equivalent.
1284 *
1285 * XXX We treat O_DSYNC as O_FSYNC for now, since we can not delay
1286 * XXX the non-essential metadata without some additional VFS work;
1287 * XXX the intent at this point is to plumb the interface for it.
1288 */
1289 if ((fp->fp_glob->fg_flag & (O_FSYNC | O_DSYNC)) ||
1290 (vp->v_mount && (vp->v_mount->mnt_flag & MNT_SYNCHRONOUS))) {
1291 ioflag |= IO_SYNC;
1292 }
1293
1294 if ((flags & FOF_OFFSET) == 0) {
1295 write_offset = fp->fp_glob->fg_offset;
1296 uio_setoffset(uio, write_offset);
1297 } else {
1298 /* for pwrite, append should be ignored */
1299 ioflag &= ~IO_APPEND;
1300 write_offset = uio_offset(uio);
1301 /* POSIX allows negative offsets for character devices. */
1302 if ((write_offset < 0) && (vnode_vtype(vp) != VCHR)) {
1303 error = EINVAL;
1304 goto error_out;
1305 }
1306 }
1307
1308 if (write_offset == INT64_MAX) {
1309 /* writes are not possible */
1310 error = EFBIG;
1311 goto error_out;
1312 }
1313
1314 /*
1315 * write_len is the original write length that was requested.
1316 * We may however need to reduce that becasue of two reasons
1317 *
1318 * 1) If write_offset + write_len will exceed OFF_T_MAX (i.e. INT64_MAX)
1319 * and/or
1320 * 2) If write_offset + write_len will exceed the administrative
1321 * limit for the maximum file size.
1322 *
1323 * In both cases the write will be denied if we can't write even a single
1324 * byte otherwise it will be "clipped" (i.e. a short write).
1325 */
1326
1327 /*
1328 * If offset + len will cause overflow, reduce the len
1329 * to a value (adjusted_write_len) where it won't
1330 */
1331 if ((write_offset >= 0) && (INT64_MAX - write_offset) < write_len) {
1332 /*
1333 * 0 write_offset INT64_MAX
1334 * |-----------------------------------------------|----------|~~~
1335 * <--write_len-->
1336 * <-adjusted->
1337 */
1338 adjusted_write_len = (user_ssize_t)(INT64_MAX - write_offset);
1339 }
1340
1341 /* write_end_offset will always be [0, INT64_MAX] */
1342 write_end_offset = write_offset + adjusted_write_len;
1343
1344 if (p && (vp->v_type == VREG) &&
1345 (rlim_cur_fsize != RLIM_INFINITY) &&
1346 (rlim_cur_fsize <= INT64_MAX) &&
1347 (write_end_offset > (off_t)rlim_cur_fsize)) {
1348 /*
1349 * If the requested residual would cause us to go past the
1350 * administrative limit, then we need to adjust the residual
1351 * down to cause fewer bytes than requested to be written. If
1352 * we can't do that (e.g. the residual is already 1 byte),
1353 * then we fail the write with EFBIG.
1354 */
1355 if (write_offset >= (off_t)rlim_cur_fsize) {
1356 /*
1357 * 0 rlim_fsize write_offset write_end INT64_MAX
1358 * |------------------------|----------|-------------|--------|
1359 * <--write_len-->
1360 *
1361 * write not permitted
1362 */
1363 psignal(p, SIGXFSZ);
1364 error = EFBIG;
1365 goto error_out;
1366 }
1367
1368 /*
1369 * 0 write_offset rlim_fsize write_end INT64_MAX
1370 * |------------------------|-----------|---------|------------|
1371 * <------write_len------>
1372 * <-adjusted-->
1373 */
1374 adjusted_write_len = (user_ssize_t)((off_t)rlim_cur_fsize - write_offset);
1375 assert((adjusted_write_len > 0) && (adjusted_write_len < write_len));
1376 }
1377
1378 if (adjusted_write_len < write_len) {
1379 uio_setresid(uio, adjusted_write_len);
1380 clippedsize = write_len - adjusted_write_len;
1381 }
1382
1383 error = VNOP_WRITE(vp, uio, ioflag, ctx);
1384
1385 /*
1386 * If we had to reduce the size of write requested either because
1387 * of rlimit or because it would have exceeded
1388 * maximum file size, we have to add that back to the residual so
1389 * it correctly reflects what we did in this function.
1390 */
1391 if (clippedsize) {
1392 uio_setresid(uio, (uio_resid(uio) + clippedsize));
1393 }
1394
1395 if ((flags & FOF_OFFSET) == 0) {
1396 if (ioflag & IO_APPEND) {
1397 fp->fp_glob->fg_offset = uio_offset(uio);
1398 } else {
1399 fp->fp_glob->fg_offset += (write_len - uio_resid(uio));
1400 }
1401 if (offset_locked) {
1402 vn_offset_unlock(fp->fp_glob);
1403 offset_locked = false;
1404 }
1405 }
1406
1407 /*
1408 * Set the credentials on successful writes
1409 */
1410 if ((error == 0) && (vp->v_tag == VT_NFS) && (UBCINFOEXISTS(vp))) {
1411 /*
1412 * When called from aio subsystem, we only have the proc from
1413 * which to get the credential, at this point, so use that
1414 * instead. This means aio functions are incompatible with
1415 * per-thread credentials (aio operations are proxied). We
1416 * can't easily correct the aio vs. settid race in this case
1417 * anyway, so we disallow it.
1418 */
1419 if ((flags & FOF_PCRED) == 0) {
1420 ubc_setthreadcred(vp, p, current_thread());
1421 } else {
1422 ubc_setcred(vp, p);
1423 }
1424 }
1425
1426 #if CONFIG_FILE_LEASES
1427 /*
1428 * On success, break the parent dir lease as the file's attributes (size
1429 * and/or mtime) have changed. Best attempt to break lease, just drop the
1430 * the error upon failure as there is no point to return error when the
1431 * write has completed successfully.
1432 */
1433 if (__probable(error == 0)) {
1434 vnode_breakdirlease(vp, true, O_WRONLY);
1435 }
1436 #endif /* CONFIG_FILE_LEASES */
1437
1438 (void)vnode_put(vp);
1439 return error;
1440
1441 error_out:
1442 if (offset_locked) {
1443 vn_offset_unlock(fp->fp_glob);
1444 }
1445 (void)vnode_put(vp);
1446 return error;
1447 }
1448
1449 /*
1450 * File table vnode stat routine.
1451 *
1452 * Returns: 0 Success
1453 * EBADF
1454 * ENOMEM
1455 * vnode_getattr:???
1456 */
1457 int
vn_stat_noauth(struct vnode * vp,void * sbptr,kauth_filesec_t * xsec,int isstat64,int needsrealdev,vfs_context_t ctx,struct ucred * file_cred)1458 vn_stat_noauth(struct vnode *vp, void *sbptr, kauth_filesec_t *xsec, int isstat64,
1459 int needsrealdev, vfs_context_t ctx, struct ucred *file_cred)
1460 {
1461 struct vnode_attr va;
1462 int error;
1463 u_short mode;
1464 kauth_filesec_t fsec;
1465 struct stat *sb = (struct stat *)0; /* warning avoidance ; protected by isstat64 */
1466 struct stat64 * sb64 = (struct stat64 *)0; /* warning avoidance ; protected by isstat64 */
1467
1468 if (isstat64 != 0) {
1469 sb64 = (struct stat64 *)sbptr;
1470 } else {
1471 sb = (struct stat *)sbptr;
1472 }
1473 memset(&va, 0, sizeof(va));
1474 VATTR_INIT(&va);
1475 VATTR_WANTED(&va, va_fsid);
1476 VATTR_WANTED(&va, va_fileid);
1477 VATTR_WANTED(&va, va_mode);
1478 VATTR_WANTED(&va, va_type);
1479 VATTR_WANTED(&va, va_nlink);
1480 VATTR_WANTED(&va, va_uid);
1481 VATTR_WANTED(&va, va_gid);
1482 VATTR_WANTED(&va, va_rdev);
1483 VATTR_WANTED(&va, va_data_size);
1484 VATTR_WANTED(&va, va_access_time);
1485 VATTR_WANTED(&va, va_modify_time);
1486 VATTR_WANTED(&va, va_change_time);
1487 VATTR_WANTED(&va, va_create_time);
1488 VATTR_WANTED(&va, va_flags);
1489 VATTR_WANTED(&va, va_gen);
1490 VATTR_WANTED(&va, va_iosize);
1491 /* lower layers will synthesise va_total_alloc from va_data_size if required */
1492 VATTR_WANTED(&va, va_total_alloc);
1493 if (xsec != NULL) {
1494 VATTR_WANTED(&va, va_uuuid);
1495 VATTR_WANTED(&va, va_guuid);
1496 VATTR_WANTED(&va, va_acl);
1497 }
1498 if (needsrealdev) {
1499 va.va_vaflags = VA_REALFSID;
1500 }
1501 error = vnode_getattr(vp, &va, ctx);
1502 if (error) {
1503 goto out;
1504 }
1505 #if CONFIG_MACF
1506 /*
1507 * Give MAC polices a chance to reject or filter the attributes
1508 * returned by the filesystem. Note that MAC policies are consulted
1509 * *after* calling the filesystem because filesystems can return more
1510 * attributes than were requested so policies wouldn't be authoritative
1511 * is consulted beforehand. This also gives policies an opportunity
1512 * to change the values of attributes retrieved.
1513 */
1514 error = mac_vnode_check_getattr(ctx, file_cred, vp, &va);
1515 if (error) {
1516 goto out;
1517 }
1518 #endif
1519 /*
1520 * Copy from vattr table
1521 */
1522 if (isstat64 != 0) {
1523 sb64->st_dev = va.va_fsid;
1524 sb64->st_ino = (ino64_t)va.va_fileid;
1525 } else {
1526 sb->st_dev = va.va_fsid;
1527 sb->st_ino = (ino_t)va.va_fileid;
1528 }
1529 mode = va.va_mode;
1530 switch (vp->v_type) {
1531 case VREG:
1532 mode |= S_IFREG;
1533 break;
1534 case VDIR:
1535 mode |= S_IFDIR;
1536 break;
1537 case VBLK:
1538 mode |= S_IFBLK;
1539 break;
1540 case VCHR:
1541 mode |= S_IFCHR;
1542 break;
1543 case VLNK:
1544 mode |= S_IFLNK;
1545 break;
1546 case VSOCK:
1547 mode |= S_IFSOCK;
1548 break;
1549 case VFIFO:
1550 mode |= S_IFIFO;
1551 break;
1552 default:
1553 error = EBADF;
1554 goto out;
1555 }
1556 ;
1557 if (isstat64 != 0) {
1558 sb64->st_mode = mode;
1559 sb64->st_nlink = VATTR_IS_SUPPORTED(&va, va_nlink) ? va.va_nlink > UINT16_MAX ? UINT16_MAX : (u_int16_t)va.va_nlink : 1;
1560 sb64->st_uid = va.va_uid;
1561 sb64->st_gid = va.va_gid;
1562 sb64->st_rdev = va.va_rdev;
1563 sb64->st_size = va.va_data_size;
1564 sb64->st_atimespec = va.va_access_time;
1565 sb64->st_mtimespec = va.va_modify_time;
1566 sb64->st_ctimespec = va.va_change_time;
1567 if (VATTR_IS_SUPPORTED(&va, va_create_time)) {
1568 sb64->st_birthtimespec = va.va_create_time;
1569 } else {
1570 sb64->st_birthtimespec.tv_sec = sb64->st_birthtimespec.tv_nsec = 0;
1571 }
1572 sb64->st_blksize = va.va_iosize;
1573 sb64->st_flags = va.va_flags;
1574 sb64->st_blocks = roundup(va.va_total_alloc, 512) / 512;
1575 } else {
1576 sb->st_mode = mode;
1577 sb->st_nlink = VATTR_IS_SUPPORTED(&va, va_nlink) ? va.va_nlink > UINT16_MAX ? UINT16_MAX : (u_int16_t)va.va_nlink : 1;
1578 sb->st_uid = va.va_uid;
1579 sb->st_gid = va.va_gid;
1580 sb->st_rdev = va.va_rdev;
1581 sb->st_size = va.va_data_size;
1582 sb->st_atimespec = va.va_access_time;
1583 sb->st_mtimespec = va.va_modify_time;
1584 sb->st_ctimespec = va.va_change_time;
1585 sb->st_blksize = va.va_iosize;
1586 sb->st_flags = va.va_flags;
1587 sb->st_blocks = roundup(va.va_total_alloc, 512) / 512;
1588 }
1589
1590 /* if we're interested in extended security data and we got an ACL */
1591 if (xsec != NULL) {
1592 if (!VATTR_IS_SUPPORTED(&va, va_acl) &&
1593 !VATTR_IS_SUPPORTED(&va, va_uuuid) &&
1594 !VATTR_IS_SUPPORTED(&va, va_guuid)) {
1595 *xsec = KAUTH_FILESEC_NONE;
1596 } else {
1597 if (VATTR_IS_SUPPORTED(&va, va_acl) && (va.va_acl != NULL)) {
1598 fsec = kauth_filesec_alloc(va.va_acl->acl_entrycount);
1599 } else {
1600 fsec = kauth_filesec_alloc(0);
1601 }
1602 if (fsec == NULL) {
1603 error = ENOMEM;
1604 goto out;
1605 }
1606 fsec->fsec_magic = KAUTH_FILESEC_MAGIC;
1607 if (VATTR_IS_SUPPORTED(&va, va_uuuid)) {
1608 fsec->fsec_owner = va.va_uuuid;
1609 } else {
1610 fsec->fsec_owner = kauth_null_guid;
1611 }
1612 if (VATTR_IS_SUPPORTED(&va, va_guuid)) {
1613 fsec->fsec_group = va.va_guuid;
1614 } else {
1615 fsec->fsec_group = kauth_null_guid;
1616 }
1617 if (VATTR_IS_SUPPORTED(&va, va_acl) && (va.va_acl != NULL)) {
1618 __nochk_bcopy(va.va_acl, &(fsec->fsec_acl), KAUTH_ACL_COPYSIZE(va.va_acl));
1619 } else {
1620 fsec->fsec_acl.acl_entrycount = KAUTH_FILESEC_NOACL;
1621 }
1622 *xsec = fsec;
1623 }
1624 }
1625
1626 /* Do not give the generation number out to unpriviledged users */
1627 if (va.va_gen && !vfs_context_issuser(ctx)) {
1628 if (isstat64 != 0) {
1629 sb64->st_gen = 0;
1630 } else {
1631 sb->st_gen = 0;
1632 }
1633 } else {
1634 if (isstat64 != 0) {
1635 sb64->st_gen = va.va_gen;
1636 } else {
1637 sb->st_gen = va.va_gen;
1638 }
1639 }
1640
1641 error = 0;
1642 out:
1643 if (VATTR_IS_SUPPORTED(&va, va_acl) && va.va_acl != NULL) {
1644 kauth_acl_free(va.va_acl);
1645 }
1646 return error;
1647 }
1648
1649 int
vn_stat(struct vnode * vp,void * sb,kauth_filesec_t * xsec,int isstat64,int needsrealdev,vfs_context_t ctx)1650 vn_stat(struct vnode *vp, void *sb, kauth_filesec_t *xsec, int isstat64, int needsrealdev, vfs_context_t ctx)
1651 {
1652 int error;
1653
1654 #if CONFIG_MACF
1655 error = mac_vnode_check_stat(ctx, NOCRED, vp);
1656 if (error) {
1657 return error;
1658 }
1659 #endif
1660
1661 /* authorize */
1662 if ((error = vnode_authorize(vp, NULL, KAUTH_VNODE_READ_ATTRIBUTES | KAUTH_VNODE_READ_SECURITY, ctx)) != 0) {
1663 return error;
1664 }
1665
1666 /* actual stat */
1667 return vn_stat_noauth(vp, sb, xsec, isstat64, needsrealdev, ctx, NOCRED);
1668 }
1669
1670
1671 /*
1672 * File table vnode ioctl routine.
1673 */
1674 static int
vn_ioctl(struct fileproc * fp,u_long com,caddr_t data,vfs_context_t ctx)1675 vn_ioctl(struct fileproc *fp, u_long com, caddr_t data, vfs_context_t ctx)
1676 {
1677 struct vnode *vp = (struct vnode *)fp_get_data(fp);
1678 off_t file_size;
1679 int error;
1680 struct vnode *ttyvp;
1681
1682 if ((error = vnode_getwithref(vp))) {
1683 return error;
1684 }
1685
1686 #if CONFIG_MACF
1687 error = mac_vnode_check_ioctl(ctx, vp, com);
1688 if (error) {
1689 goto out;
1690 }
1691 #endif
1692
1693 switch (vp->v_type) {
1694 case VREG:
1695 case VDIR:
1696 if (com == FIONREAD) {
1697 off_t temp_nbytes;
1698 if ((error = vnode_size(vp, &file_size, ctx)) != 0) {
1699 goto out;
1700 }
1701 temp_nbytes = file_size - fp->fp_glob->fg_offset;
1702 if (temp_nbytes > INT_MAX) {
1703 *(int *)data = INT_MAX;
1704 } else if (temp_nbytes < 0) {
1705 *(int *)data = 0;
1706 } else {
1707 *(int *)data = (int)temp_nbytes;
1708 }
1709 goto out;
1710 }
1711 if (com == FIONBIO || com == FIOASYNC) { /* XXX */
1712 goto out;
1713 }
1714 OS_FALLTHROUGH;
1715
1716 default:
1717 error = ENOTTY;
1718 goto out;
1719
1720 case VFIFO:
1721 case VCHR:
1722 case VBLK:
1723
1724 if (com == TIOCREVOKE || com == TIOCREVOKECLEAR) {
1725 error = ENOTTY;
1726 goto out;
1727 }
1728
1729 /* Should not be able to set block size from user space */
1730 if (com == DKIOCSETBLOCKSIZE) {
1731 error = EPERM;
1732 goto out;
1733 }
1734
1735 /* Should not be able to check if filesystem is authenticated from user space */
1736 if (com == FSIOC_AUTH_FS) {
1737 error = ENOTTY;
1738 goto out;
1739 }
1740
1741 if (com == FIODTYPE) {
1742 if (vp->v_type == VBLK) {
1743 if (major(vp->v_rdev) >= nblkdev) {
1744 error = ENXIO;
1745 goto out;
1746 }
1747 *(int *)data = bdevsw[major(vp->v_rdev)].d_type;
1748 } else if (vp->v_type == VCHR) {
1749 if (major(vp->v_rdev) >= nchrdev) {
1750 error = ENXIO;
1751 goto out;
1752 }
1753 *(int *)data = cdevsw[major(vp->v_rdev)].d_type;
1754 } else {
1755 error = ENOTTY;
1756 goto out;
1757 }
1758 goto out;
1759 }
1760 error = VNOP_IOCTL(vp, com, data, fp->fp_glob->fg_flag, ctx);
1761
1762 if (error == 0 && com == TIOCSCTTY) {
1763 struct session *sessp;
1764 struct pgrp *pg;
1765
1766 pg = proc_pgrp(vfs_context_proc(ctx), &sessp);
1767
1768 session_lock(sessp);
1769 ttyvp = sessp->s_ttyvp;
1770 sessp->s_ttyvp = vp;
1771 sessp->s_ttyvid = vnode_vid(vp);
1772 session_unlock(sessp);
1773
1774 pgrp_rele(pg);
1775 }
1776 }
1777 out:
1778 (void)vnode_put(vp);
1779 return error;
1780 }
1781
1782 /*
1783 * File table vnode select routine.
1784 */
1785 static int
vn_select(struct fileproc * fp,int which,void * wql,__unused vfs_context_t ctx)1786 vn_select(struct fileproc *fp, int which, void *wql, __unused vfs_context_t ctx)
1787 {
1788 int error;
1789 struct vnode * vp = (struct vnode *)fp_get_data(fp);
1790 struct vfs_context context;
1791
1792 if ((error = vnode_getwithref(vp)) == 0) {
1793 context.vc_thread = current_thread();
1794 context.vc_ucred = fp->fp_glob->fg_cred;
1795
1796 #if CONFIG_MACF
1797 /*
1798 * XXX We should use a per thread credential here; minimally,
1799 * XXX the process credential should have a persistent
1800 * XXX reference on it before being passed in here.
1801 */
1802 error = mac_vnode_check_select(ctx, vp, which);
1803 if (error == 0)
1804 #endif
1805 error = VNOP_SELECT(vp, which, fp->fp_glob->fg_flag, wql, ctx);
1806
1807 (void)vnode_put(vp);
1808 }
1809 return error;
1810 }
1811
1812 /*
1813 * File table vnode close routine.
1814 */
1815 static int
vn_closefile(struct fileglob * fg,vfs_context_t ctx)1816 vn_closefile(struct fileglob *fg, vfs_context_t ctx)
1817 {
1818 struct vnode *vp = fg_get_data(fg);
1819 int error;
1820
1821 if ((error = vnode_getwithref(vp)) == 0) {
1822 if (FILEGLOB_DTYPE(fg) == DTYPE_VNODE &&
1823 ((fg->fg_flag & FWASLOCKED) != 0 ||
1824 (fg->fg_lflags & FG_HAS_OFDLOCK) != 0)) {
1825 struct flock lf = {
1826 .l_whence = SEEK_SET,
1827 .l_start = 0,
1828 .l_len = 0,
1829 .l_type = F_UNLCK
1830 };
1831
1832 if ((fg->fg_flag & FWASLOCKED) != 0) {
1833 (void) VNOP_ADVLOCK(vp, (caddr_t)fg,
1834 F_UNLCK, &lf, F_FLOCK, ctx, NULL);
1835 }
1836
1837 if ((fg->fg_lflags & FG_HAS_OFDLOCK) != 0) {
1838 (void) VNOP_ADVLOCK(vp, (caddr_t)fg,
1839 F_UNLCK, &lf, F_OFD_LOCK, ctx, NULL);
1840 }
1841 }
1842 #if CONFIG_FILE_LEASES
1843 if (FILEGLOB_DTYPE(fg) == DTYPE_VNODE && !LIST_EMPTY(&vp->v_leases)) {
1844 /* Expected open count doesn't matter for release. */
1845 (void)vnode_setlease(vp, fg, F_UNLCK, 0, ctx);
1846 }
1847 #endif
1848 error = vn_close(vp, fg->fg_flag, ctx);
1849 (void) vnode_put(vp);
1850 }
1851 return error;
1852 }
1853
1854 /*
1855 * Returns: 0 Success
1856 * VNOP_PATHCONF:???
1857 */
1858 int
vn_pathconf(vnode_t vp,int name,int32_t * retval,vfs_context_t ctx)1859 vn_pathconf(vnode_t vp, int name, int32_t *retval, vfs_context_t ctx)
1860 {
1861 int error = 0;
1862 struct vfs_attr vfa;
1863
1864 switch (name) {
1865 case _PC_EXTENDED_SECURITY_NP:
1866 *retval = vfs_extendedsecurity(vnode_mount(vp)) ? 1 : 0;
1867 break;
1868 case _PC_AUTH_OPAQUE_NP:
1869 *retval = vfs_authopaque(vnode_mount(vp));
1870 break;
1871 case _PC_2_SYMLINKS:
1872 *retval = 1; /* XXX NOTSUP on MSDOS, etc. */
1873 break;
1874 case _PC_ALLOC_SIZE_MIN:
1875 *retval = 1; /* XXX lie: 1 byte */
1876 break;
1877 case _PC_ASYNC_IO: /* unistd.h: _POSIX_ASYNCHRONUS_IO */
1878 *retval = 1; /* [AIO] option is supported */
1879 break;
1880 case _PC_PRIO_IO: /* unistd.h: _POSIX_PRIORITIZED_IO */
1881 *retval = 0; /* [PIO] option is not supported */
1882 break;
1883 case _PC_REC_INCR_XFER_SIZE:
1884 *retval = 4096; /* XXX go from MIN to MAX 4K at a time */
1885 break;
1886 case _PC_REC_MIN_XFER_SIZE:
1887 *retval = 4096; /* XXX recommend 4K minimum reads/writes */
1888 break;
1889 case _PC_REC_MAX_XFER_SIZE:
1890 *retval = 65536; /* XXX recommend 64K maximum reads/writes */
1891 break;
1892 case _PC_REC_XFER_ALIGN:
1893 *retval = 4096; /* XXX recommend page aligned buffers */
1894 break;
1895 case _PC_SYMLINK_MAX:
1896 *retval = 255; /* Minimum acceptable POSIX value */
1897 break;
1898 case _PC_SYNC_IO: /* unistd.h: _POSIX_SYNCHRONIZED_IO */
1899 *retval = 0; /* [SIO] option is not supported */
1900 break;
1901 case _PC_XATTR_SIZE_BITS:
1902 /* The number of bits used to store maximum extended
1903 * attribute size in bytes. For example, if the maximum
1904 * attribute size supported by a file system is 128K, the
1905 * value returned will be 18. However a value 18 can mean
1906 * that the maximum attribute size can be anywhere from
1907 * (256KB - 1) to 128KB. As a special case, the resource
1908 * fork can have much larger size, and some file system
1909 * specific extended attributes can have smaller and preset
1910 * size; for example, Finder Info is always 32 bytes.
1911 */
1912 memset(&vfa, 0, sizeof(vfa));
1913 VFSATTR_INIT(&vfa);
1914 VFSATTR_WANTED(&vfa, f_capabilities);
1915 if (vfs_getattr(vnode_mount(vp), &vfa, ctx) == 0 &&
1916 (VFSATTR_IS_SUPPORTED(&vfa, f_capabilities)) &&
1917 (vfa.f_capabilities.capabilities[VOL_CAPABILITIES_INTERFACES] & VOL_CAP_INT_EXTENDED_ATTR) &&
1918 (vfa.f_capabilities.valid[VOL_CAPABILITIES_INTERFACES] & VOL_CAP_INT_EXTENDED_ATTR)) {
1919 /* Supports native extended attributes */
1920 error = VNOP_PATHCONF(vp, name, retval, ctx);
1921 } else {
1922 /* Number of bits used to represent the maximum size of
1923 * extended attribute stored in an Apple Double file.
1924 */
1925 *retval = AD_XATTR_SIZE_BITS;
1926 }
1927 break;
1928 default:
1929 error = VNOP_PATHCONF(vp, name, retval, ctx);
1930 break;
1931 }
1932
1933 return error;
1934 }
1935
1936 static int
vn_kqfilter(struct fileproc * fp,struct knote * kn,struct kevent_qos_s * kev)1937 vn_kqfilter(struct fileproc *fp, struct knote *kn, struct kevent_qos_s *kev)
1938 {
1939 vfs_context_t ctx = vfs_context_current();
1940 struct vnode *vp;
1941 int error = 0;
1942 int result = 0;
1943
1944 vp = (struct vnode *)fp_get_data(fp);
1945
1946 /*
1947 * Don't attach a knote to a dead vnode.
1948 */
1949 if ((error = vget_internal(vp, 0, VNODE_NODEAD)) == 0) {
1950 switch (kn->kn_filter) {
1951 case EVFILT_READ:
1952 case EVFILT_WRITE:
1953 if (vnode_isfifo(vp)) {
1954 /* We'll only watch FIFOs that use our fifofs */
1955 if (!(vp->v_fifoinfo && vp->v_fifoinfo->fi_readsock)) {
1956 error = ENOTSUP;
1957 }
1958 } else if (!vnode_isreg(vp)) {
1959 if (vnode_ischr(vp)) {
1960 result = spec_kqfilter(vp, kn, kev);
1961 if ((kn->kn_flags & EV_ERROR) == 0) {
1962 /* claimed by a special device */
1963 vnode_put(vp);
1964 return result;
1965 }
1966 }
1967 error = EINVAL;
1968 }
1969 break;
1970 case EVFILT_VNODE:
1971 break;
1972 default:
1973 error = EINVAL;
1974 }
1975
1976 if (error == 0) {
1977 #if CONFIG_MACF
1978 error = mac_vnode_check_kqfilter(ctx, fp->fp_glob->fg_cred, kn, vp);
1979 if (error) {
1980 vnode_put(vp);
1981 goto out;
1982 }
1983 #endif
1984
1985 kn->kn_hook = (void*)vp;
1986 kn->kn_filtid = EVFILTID_VN;
1987 vnode_hold(vp);
1988
1989 vnode_lock(vp);
1990 KNOTE_ATTACH(&vp->v_knotes, kn);
1991 result = filt_vnode_common(kn, NULL, vp, 0);
1992 vnode_unlock(vp);
1993
1994 /*
1995 * Ask the filesystem to provide remove notifications,
1996 * but ignore failure
1997 */
1998 VNOP_MONITOR(vp, 0, VNODE_MONITOR_BEGIN, (void*) kn, ctx);
1999 }
2000
2001 vnode_put(vp);
2002 }
2003
2004 out:
2005 if (error) {
2006 knote_set_error(kn, error);
2007 }
2008
2009 return result;
2010 }
2011
2012 static void
filt_vndetach(struct knote * kn)2013 filt_vndetach(struct knote *kn)
2014 {
2015 vfs_context_t ctx = vfs_context_current();
2016 struct vnode *vp = (struct vnode *)kn->kn_hook;
2017 uint32_t vid = vnode_vid(vp);
2018 if (vnode_getwithvid(vp, vid)) {
2019 vnode_drop(vp);
2020 return;
2021 }
2022 vnode_drop(vp);
2023
2024 vnode_lock(vp);
2025 KNOTE_DETACH(&vp->v_knotes, kn);
2026 vnode_unlock(vp);
2027
2028 /*
2029 * Tell a (generally networked) filesystem that we're no longer watching
2030 * If the FS wants to track contexts, it should still be using the one from
2031 * the VNODE_MONITOR_BEGIN.
2032 */
2033 VNOP_MONITOR(vp, 0, VNODE_MONITOR_END, (void*)kn, ctx);
2034 vnode_put(vp);
2035 }
2036
2037
2038 /*
2039 * Used for EVFILT_READ
2040 *
2041 * Takes only VFIFO or VREG. vnode is locked. We handle the "poll" case
2042 * differently than the regular case for VREG files. If not in poll(),
2043 * then we need to know current fileproc offset for VREG.
2044 */
2045 static int64_t
vnode_readable_data_count(vnode_t vp,off_t current_offset,int ispoll)2046 vnode_readable_data_count(vnode_t vp, off_t current_offset, int ispoll)
2047 {
2048 if (vnode_isfifo(vp)) {
2049 #if FIFO
2050 int cnt;
2051 int err = fifo_charcount(vp, &cnt);
2052 if (err == 0) {
2053 return (int64_t)cnt;
2054 } else
2055 #endif
2056 {
2057 return 0;
2058 }
2059 } else if (vnode_isreg(vp)) {
2060 if (ispoll) {
2061 return 1;
2062 }
2063
2064 off_t amount;
2065 amount = vp->v_un.vu_ubcinfo->ui_size - current_offset;
2066 if (amount > INT64_MAX) {
2067 return INT64_MAX;
2068 } else if (amount < INT64_MIN) {
2069 return INT64_MIN;
2070 } else {
2071 return (int64_t)amount;
2072 }
2073 } else {
2074 panic("Should never have an EVFILT_READ except for reg or fifo.");
2075 return 0;
2076 }
2077 }
2078
2079 /*
2080 * Used for EVFILT_WRITE.
2081 *
2082 * For regular vnodes, we can always write (1). For named pipes,
2083 * see how much space there is in the buffer. Nothing else is covered.
2084 */
2085 static intptr_t
vnode_writable_space_count(vnode_t vp)2086 vnode_writable_space_count(vnode_t vp)
2087 {
2088 if (vnode_isfifo(vp)) {
2089 #if FIFO
2090 long spc;
2091 int err = fifo_freespace(vp, &spc);
2092 if (err == 0) {
2093 return (intptr_t)spc;
2094 } else
2095 #endif
2096 {
2097 return (intptr_t)0;
2098 }
2099 } else if (vnode_isreg(vp)) {
2100 return (intptr_t)1;
2101 } else {
2102 panic("Should never have an EVFILT_READ except for reg or fifo.");
2103 return 0;
2104 }
2105 }
2106
2107 /*
2108 * Determine whether this knote should be active
2109 *
2110 * This is kind of subtle.
2111 * --First, notice if the vnode has been revoked: in so, override hint
2112 * --EVFILT_READ knotes are checked no matter what the hint is
2113 * --Other knotes activate based on hint.
2114 * --If hint is revoke, set special flags and activate
2115 */
2116 static int
filt_vnode_common(struct knote * kn,struct kevent_qos_s * kev,vnode_t vp,long hint)2117 filt_vnode_common(struct knote *kn, struct kevent_qos_s *kev, vnode_t vp, long hint)
2118 {
2119 int activate = 0;
2120 int64_t data = 0;
2121
2122 lck_mtx_assert(&vp->v_lock, LCK_MTX_ASSERT_OWNED);
2123
2124 /* Special handling for vnodes that are in recycle or already gone */
2125 if (NOTE_REVOKE == hint) {
2126 kn->kn_flags |= (EV_EOF | EV_ONESHOT);
2127 activate = 1;
2128
2129 if ((kn->kn_filter == EVFILT_VNODE) && (kn->kn_sfflags & NOTE_REVOKE)) {
2130 kn->kn_fflags |= NOTE_REVOKE;
2131 }
2132 } else {
2133 switch (kn->kn_filter) {
2134 case EVFILT_READ:
2135 data = vnode_readable_data_count(vp, kn->kn_fp->fp_glob->fg_offset, (kn->kn_flags & EV_POLL));
2136 activate = (data != 0);
2137 break;
2138 case EVFILT_WRITE:
2139 data = vnode_writable_space_count(vp);
2140 activate = (data != 0);
2141 break;
2142 case EVFILT_VNODE:
2143 /* Check events this note matches against the hint */
2144 if (kn->kn_sfflags & hint) {
2145 kn->kn_fflags |= (uint32_t)hint; /* Set which event occurred */
2146 }
2147 activate = (kn->kn_fflags != 0);
2148 break;
2149 default:
2150 panic("Invalid knote filter on a vnode!");
2151 }
2152 }
2153
2154 if (kev && activate) {
2155 knote_fill_kevent(kn, kev, data);
2156 }
2157
2158 return activate;
2159 }
2160
2161 static int
filt_vnode(struct knote * kn,long hint)2162 filt_vnode(struct knote *kn, long hint)
2163 {
2164 vnode_t vp = (struct vnode *)kn->kn_hook;
2165
2166 return filt_vnode_common(kn, NULL, vp, hint);
2167 }
2168
2169 static int
filt_vntouch(struct knote * kn,struct kevent_qos_s * kev)2170 filt_vntouch(struct knote *kn, struct kevent_qos_s *kev)
2171 {
2172 vnode_t vp = (struct vnode *)kn->kn_hook;
2173 uint32_t vid = vnode_vid(vp);
2174 int activate;
2175 int hint = 0;
2176
2177 vnode_lock(vp);
2178 if (vnode_getiocount(vp, vid, VNODE_NODEAD | VNODE_WITHID) != 0) {
2179 /* is recycled */
2180 hint = NOTE_REVOKE;
2181 }
2182
2183 /* accept new input fflags mask */
2184 kn->kn_sfflags = kev->fflags;
2185
2186 activate = filt_vnode_common(kn, NULL, vp, hint);
2187
2188 if (hint == 0) {
2189 vnode_put_locked(vp);
2190 }
2191 vnode_unlock(vp);
2192
2193 return activate;
2194 }
2195
2196 static int
filt_vnprocess(struct knote * kn,struct kevent_qos_s * kev)2197 filt_vnprocess(struct knote *kn, struct kevent_qos_s *kev)
2198 {
2199 vnode_t vp = (struct vnode *)kn->kn_hook;
2200 uint32_t vid = vnode_vid(vp);
2201 int activate;
2202 int hint = 0;
2203
2204 vnode_lock(vp);
2205 if (vnode_getiocount(vp, vid, VNODE_NODEAD | VNODE_WITHID) != 0) {
2206 /* Is recycled */
2207 hint = NOTE_REVOKE;
2208 }
2209 activate = filt_vnode_common(kn, kev, vp, hint);
2210
2211 /* Definitely need to unlock, may need to put */
2212 if (hint == 0) {
2213 vnode_put_locked(vp);
2214 }
2215 vnode_unlock(vp);
2216
2217 return activate;
2218 }
2219
2220 struct vniodesc {
2221 vnode_t vnio_vnode; /* associated vnode */
2222 int vnio_fflags; /* cached fileglob flags */
2223 };
2224
2225 errno_t
vnio_openfd(int fd,vniodesc_t * vniop)2226 vnio_openfd(int fd, vniodesc_t *vniop)
2227 {
2228 proc_t p = current_proc();
2229 struct fileproc *fp = NULL;
2230 vniodesc_t vnio;
2231 vnode_t vp;
2232 int error;
2233 bool need_drop = false;
2234
2235 vnio = kalloc_type(struct vniodesc, Z_WAITOK);
2236
2237 error = fp_getfvp(p, fd, &fp, &vp);
2238 if (error) {
2239 goto out;
2240 }
2241 need_drop = true;
2242
2243 if ((fp->fp_glob->fg_flag & (FREAD | FWRITE)) == 0) {
2244 error = EBADF;
2245 goto out;
2246 }
2247
2248 if (vnode_isswap(vp)) {
2249 error = EPERM;
2250 goto out;
2251 }
2252
2253 if (vp->v_type != VREG) {
2254 error = EFTYPE;
2255 goto out;
2256 }
2257
2258 error = vnode_getwithref(vp);
2259 if (error) {
2260 goto out;
2261 }
2262
2263 vnio->vnio_vnode = vp;
2264 vnio->vnio_fflags = fp->fp_glob->fg_flag;
2265
2266 (void)fp_drop(p, fd, fp, 0);
2267 need_drop = false;
2268
2269 error = vnode_ref_ext(vp, vnio->vnio_fflags, 0);
2270 if (error == 0) {
2271 *vniop = vnio;
2272 vnio = NULL;
2273 }
2274
2275 vnode_put(vp);
2276
2277 out:
2278 if (need_drop) {
2279 fp_drop(p, fd, fp, 0);
2280 }
2281 if (vnio != NULL) {
2282 kfree_type(struct vniodesc, vnio);
2283 }
2284 return error;
2285 }
2286
2287 errno_t
vnio_close(vniodesc_t vnio)2288 vnio_close(vniodesc_t vnio)
2289 {
2290 int error;
2291
2292 /*
2293 * The vniodesc is always destroyed, because the close
2294 * always "succeeds". We just return whatever error
2295 * might have been encountered while doing so.
2296 */
2297
2298 error = vnode_getwithref(vnio->vnio_vnode);
2299 if (error == 0) {
2300 error = vnode_close(vnio->vnio_vnode, vnio->vnio_fflags, NULL);
2301 }
2302
2303 kfree_type(struct vniodesc, vnio);
2304
2305 return error;
2306 }
2307
2308 errno_t
vnio_read(vniodesc_t vnio,uio_t uio)2309 vnio_read(vniodesc_t vnio, uio_t uio)
2310 {
2311 vnode_t vp = vnio->vnio_vnode;
2312 user_ssize_t read_len;
2313 int error;
2314
2315 read_len = uio_resid(uio);
2316 if (read_len < 0 || read_len > INT_MAX) {
2317 return EINVAL;
2318 }
2319
2320 error = vnode_getwithref(vp);
2321 if (error == 0) {
2322 error = vn_read_common(vp, uio, vnio->vnio_fflags,
2323 vfs_context_current());
2324 vnode_put(vp);
2325 }
2326
2327 return error;
2328 }
2329
2330 vnode_t
vnio_vnode(vniodesc_t vnio)2331 vnio_vnode(vniodesc_t vnio)
2332 {
2333 return vnio->vnio_vnode;
2334 }
2335