Commit Graph

235 Commits

Author SHA1 Message Date
Konstantin Belousov
877d24ac8a Fix the mis-handling of the VV_TEXT on the nullfs vnodes.
If you have a binary on a filesystem which is also mounted over by
nullfs, you could execute the binary from the lower filesystem, or
from the nullfs mount. When executed from lower filesystem, the lower
vnode gets VV_TEXT flag set, and the file cannot be modified while the
binary is active. But, if executed as the nullfs alias, only the
nullfs vnode gets VV_TEXT set, and you still can open the lower vnode
for write.

Add a set of VOPs for the VV_TEXT query, set and clear operations,
which are correctly bypassed to lower vnode.

Tested by:	pho (previous version)
MFC after:	2 weeks
2012-09-28 11:25:02 +00:00
Kirk McKusick
71469bb38f Replace the MNT_VNODE_FOREACH interface with MNT_VNODE_FOREACH_ALL.
The primary changes are that the user of the interface no longer
needs to manage the mount-mutex locking and that the vnode that
is returned has its mutex locked (thus avoiding the need to check
to see if its is DOOMED or other possible end of life senarios).

To minimize compatibility issues for third-party developers, the
old MNT_VNODE_FOREACH interface will remain available so that this
change can be MFC'ed to 9. Following the MFC to 9, MNT_VNODE_FOREACH
will be removed in head.

The reason for this update is to prepare for the addition of the
MNT_VNODE_FOREACH_ACTIVE interface that will loop over just the
active vnodes associated with a mount point (typically less than
1% of the vnodes associated with the mount point).

Reviewed by: kib
Tested by:   Peter Holm
MFC after:   2 weeks
2012-04-17 16:28:22 +00:00
Robert Watson
a9d2f8d84f Second-to-last commit implementing Capsicum capabilities in the FreeBSD
kernel for FreeBSD 9.0:

Add a new capability mask argument to fget(9) and friends, allowing system
call code to declare what capabilities are required when an integer file
descriptor is converted into an in-kernel struct file *.  With options
CAPABILITIES compiled into the kernel, this enforces capability
protection; without, this change is effectively a no-op.

Some cases require special handling, such as mmap(2), which must preserve
information about the maximum rights at the time of mapping in the memory
map so that they can later be enforced in mprotect(2) -- this is done by
narrowing the rights in the existing max_protection field used for similar
purposes with file permissions.

In namei(9), we assert that the code is not reached from within capability
mode, as we're not yet ready to enforce namespace capabilities there.
This will follow in a later commit.

Update two capability names: CAP_EVENT and CAP_KEVENT become
CAP_POST_KEVENT and CAP_POLL_KEVENT to more accurately indicate what they
represent.

Approved by:	re (bz)
Submitted by:	jonathan
Sponsored by:	Google Inc
2011-08-11 12:30:23 +00:00
Konstantin Belousov
730b63b0c2 Remove prtactive variable and related printf()s in the vop_inactive
and vop_reclaim() methods. They seems to be unused, and the reported
situation is normal for the forced unmount.

MFC after:   1 week
X-MFC-note:  keep prtactive symbol in vfs_subr.c
2010-11-19 21:17:34 +00:00
Robert Watson
be80264279 Properly bounds check ioctl/pioctl data arguments for Coda:
1. Use unsigned rather than signed lengths
2. Bound messages to/from Venus to VC_MAXMSGSIZE
3. Bound messages to/from general user processes to VC_MAXDATASIZE
4. Update comment regarding data limits for pioctl

Without (1) and (3), it may be possible for unprivileged user processes to
read sensitive portions of kernel memory.  This issue is only present if
the Coda kernel module is loaded and venus (the userspace Coda daemon) is
running and has /coda mounted.

As Coda is considered experimental and production use is warned against in
the coda(4) man page, and because Coda must be explicitly configured for a
configuration to be vulnerable, we won't be issuing a security advisory.
However, if you are using Coda, then you are advised to apply these fixes.

Reported by:	Dan J. Rosenberg <drosenberg at vsecurity.com>
Obtained from:	NetBSD (Christos Zoulas)
Security:	Kernel memory disclosure; no advisory as feature experimental
MFC after:	3 days
2010-08-07 08:08:14 +00:00
Robert Watson
f1853d0fc2 Synchronize Coda kernel module definitions in our coda.h to Coda 6's
coda.h:

- CodaFid typdef -> struct CodaFid throughout.
- Use unsigned int instead of unsigned long for venus_dirent and other
  cosmetic fixes.
- Introduce cuid_t and cgid_t and use instead of uid_t and gid_t in RPCs.
- Synchronize comments and macros.
- Use u_int32_t instead of unsigned long for coda_out_hdr.

With these changes, a 64-bit Coda kernel module now works with
coda6_client, whereas previous userspace and kernel versions of RPCs
differed sufficiently to prevent using the file system.  This has been
verified only with casual testing, but /coda is now usable for at least
basic operations on amd64.

MFC after:	1 week
2010-04-05 20:12:54 +00:00
Robert Watson
1c482201ef Correct definition of CIOC_KERNEL_VERSION Coda ioctl() for systems
where sizeof(int) != sizeof(sizeof(int)), or the ioctl will return
EINVAL.

MFC after:	3 days
2010-04-05 19:40:13 +00:00
Konstantin Belousov
9f80ce043d Change the type of uio_resid member of struct uio from int to ssize_t.
Note that this does not actually enable full-range i/o requests for
64 architectures, and is done now to update KBI only.

Tested by:	pho
Reviewed by:	jhb, bde (as part of the review of the bigger patch)
2009-06-25 18:46:30 +00:00
Attilio Rao
dfd233edd5 Remove the thread argument from the FSD (File-System Dependent) parts of
the VFS.  Now all the VFS_* functions and relating parts don't want the
context as long as it always refers to curthread.

In some points, in particular when dealing with VOPs and functions living
in the same namespace (eg. vflush) which still need to be converted,
pass curthread explicitly in order to retain the old behaviour.
Such loose ends will be fixed ASAP.

While here fix a bug: now, UFS_EXTATTR can be compiled alone without the
UFS_EXTATTR_AUTOSTART option.

VFS KPI is heavilly changed by this commit so thirdy parts modules needs
to be recompiled.  Bump __FreeBSD_version in order to signal such
situation.
2009-05-11 15:33:26 +00:00
John Baldwin
ea77ff0a15 Use shared vnode locks when invoking VOP_READDIR().
MFC after:	1 month
2009-02-13 18:18:14 +00:00
Bjoern A. Zeeb
7956d34b95 Remove unused local variables.
Submitted by:	Christoph Mallon christoph.mallon@gmx.de
Reviewed by:	kib
MFC after:	2 weeks
2009-01-31 17:36:22 +00:00
Edward Tomasz Napierala
ea49f15447 Fix few missed accmode changes in coda.
Approved by:	rwatson (mentor)
2008-11-03 16:36:23 +00:00
Edward Tomasz Napierala
15bc6b2bd8 Introduce accmode_t. This is required for NFSv4 ACLs - it will be neccessary
to add more V* constants, and the variables changed by this patch were often
being assigned to mode_t variables, which is 16 bit.

Approved by:	rwatson (mentor)
2008-10-28 13:44:11 +00:00
Ed Schouten
d3ce832719 Remove unit2minor() use from kernel code.
When I changed kern_conf.c three months ago I made device unit numbers
equal to (unneeded) device minor numbers. We used to require
bitshifting, because there were eight bits in the middle that were
reserved for a device major number. Not very long after I turned
dev2unit(), minor(), unit2minor() and minor2unit() into macro's.
The unit2minor() and minor2unit() macro's were no-ops.

We'd better not remove these four macro's from the kernel, because there
is a lot of (external) code that may still depend on them. For now it's
harmless to remove all invocations of unit2minor() and minor2unit().

Reviewed by:	kib
2008-09-26 14:19:52 +00:00
Attilio Rao
0359a12ead Decontextualize the couplet VOP_GETATTR / VOP_SETATTR as the passed thread
was always curthread and totally unuseful.

Tested by: Giovanni Trematerra <giovanni dot trematerra at gmail dot com>
2008-08-28 15:23:18 +00:00
Konstantin Belousov
57b4252e45 Add the support for the AT_FDCWD and fd-relative name lookups to the
namei(9).

Based on the submission by rdivacky,
	sponsored by Google Summer of Code 2007
Reviewed by:	rwatson, rdivacky
Tested by:	pho
2008-03-31 12:01:21 +00:00
Robert Watson
18ff731caa Add "Make MPSAFE" to the Coda todo list.
MFC after:	3 days
2008-02-26 09:27:47 +00:00
Robert Watson
fa8003c6b9 Remove custom queue macros in Coda, replacing them with queue(9) tailq
macros.  The only semantic change was the need to add a vc_opened field
to struct vcomm since we can no longer use the request queue returning
to an uninitialized state to hold whether or not the device is open.

MFC after:	1 month
2008-02-17 14:33:28 +00:00
Robert Watson
b15ce9be2e Remove namecache performance-tuning todo for Coda: we now use the FreeBSD
name cache.

MFC after:	1 month
2008-02-17 12:40:27 +00:00
Robert Watson
a8c34e8ee0 The possibly interruptible msleep in coda_call() means well, but is
fundamentally fairly confused about how signals work and when it is
appropriate for upcalls to be interrupted.  In particular, we should
be exempting certain upcalls from interruption, we should not always
eventually time out sleeping on a upcall, and we should not be
interrupting the sleep for certain signals that we currently are
(including SIGINFO).  This code needs to be reworked in the style of
NFS interruptible mounts.

MFC after:	1 month
2008-02-15 13:31:35 +00:00
Robert Watson
c30ddc8d99 Spell replys as replies.
MFC after:	1 month
2008-02-15 12:11:45 +00:00
Robert Watson
93b510870f Reorder and clean up make_coda_node(), annotate weaknesses in the
implementation.

MFC after:	1 month
2008-02-15 11:58:11 +00:00
Robert Watson
c0964f549b Remove debugging code under OLD_DIAGNOSTIC; this is all >10 years old and
hasn't been used in that time.

MFC after:	1 month
2008-02-14 00:55:03 +00:00
Robert Watson
57a77b811f In Coda, flush the attribute cache for a cnode when its fid is
changed, as its synthesized inode number may have changed and we
want stat(2) to pick up the new inode number.

MFC after:	1 month
2008-02-14 00:30:06 +00:00
Robert Watson
89d1d7886a Update cache flushing behavior in light of recent namecache and
access cache improvements:

- Flush just access control state on CODA_PURGEUSER, not the full
  namecache for /coda.

- When replacing a fid on a cnode as a result of, e.g.,
  reintegration after offline operation, we no longer need to
  purge the namecache entries associated with its vnode.

MFC after:	1 month
2008-02-13 19:50:17 +00:00
Robert Watson
38ab9a906a Implement a rudimentary access cache for the Coda kernel module,
modeled on the access cache found in NFS, smbfs, and the Linux coda
module.  This is a positive access cache of a single entry per file,
tracking recently granted rights, but unlike NFS and smbfs,
supporting explicit invalidation by the distributed file system.

For each cnode, maintain a C_ACCCACHE flag indicating the validity
of the cache, and a cached uid and mode tracking recently granted
positive access control decisions.

Prefer the cache to venus_access() in VOP_ACCESS() if it is valid,
and when we must fall back to venus_access(), update the cache.

Allow Venus to clear the access cache, either the whole cache on
CODA_FLUSH, or just entries for a specific uid on CODA_PURGEUSER.
Unlike the Coda module on Linux, we don't flush all entries on a
user purge using a generation number, we instead walk present
cnodes and clear only entries for the specific user, meaning it is
somewhat more expensive but won't hit all users.

Since the Coda module is agressive about not keeping around
unopened cnodes, the utility of the cache is somewhat limited for
files, but works will for directories.  We should make Coda less
agressive about GCing cnodes in VOP_INACTIVE() in order to improve
the effectiveness of in-kernel caching of attributes and access
rights.

MFC after:	1 month
2008-02-13 15:45:12 +00:00
Robert Watson
d25a3c4c44 Remove now-unused Coda namecache.
MFC after:	1 month
2008-02-13 13:26:01 +00:00
Robert Watson
44abffb44b Rather than having the Coda module use its own namecache, use the global
VFS namecache, as is done by the Coda module on Linux.  Unlike the Coda
namecache, the global VFS namecache isn't tagged by credential, so use
ore conservative flushing behavior (for now) when CODA_PURGEUSER is
issued by Venus.

This improves overall integration with the FreeBSD VFS, including
allowing __getcwd() to work better, procfs/procstat monitoring, and so
on.  This improves shell behavior in many cases, and improves ".."
handling.  It may lead to some slowdown until we've implemented a
specific access cache, which should net improve performance, but in the
mean time, lookup access control now always goes to Venus, whereas
previously it didn't.

MFC after:	1 month
2008-02-13 13:06:22 +00:00
Robert Watson
4f52b754df Clean up coda_pathconf() slightly while debugging a problem there.
MFC after:	1 month
2008-02-11 00:01:45 +00:00
Robert Watson
21bb029533 Since we're now actively maintaining the Coda module in the FreeBSD source
tree, restyle everything but coda.h (which is more explicitly shared
across systems) into a closer approximation to style(9).

Remove a few more unused function prototypes.

Add or clarify some comments.

MFC after:	1 month
2008-02-10 11:18:12 +00:00
Robert Watson
d57786ec68 Various further non-functional cleanups to coda:
- Rename print_vattr to coda_print_vattr and make static, rename
  print_cred to coda_print_cred.
- Remove unused coda_vop_nop.
- Add XXX comment because coda_readdir forwards to the cache vnode's
  readdir rather than venus_readdir, and annotate venus_readdir as
  unused.
- Rename vc_nb_* to vc_*.
- Use d_open_t, d_close_t, d_read_t, d_write_t, d_ioctl_t and d_poll_t
  for prototyping vc_* as that is the intent, don't use our own
  definitions.
- Rename coda_nb_statfs to coda_statfs, rename NB_SFS_SIZ to
  CODA_SFS_SIZ.
- Replace one more OBE reference to NetBSD with a reference to FreeBSD.
- Tidy up a little vertical whitespace here and there.
- Annotate coda_nc_zapvnode as unused.
- Remove unused vcodattach.
- Annotate VM_INTR as unused.
- Annotate that coda_fhtovp is unused and doesn't match the FreeBSD
  prototype, so isn't hooked up to vfs_fhtovp.  If we want NFS export of
  Coda to work someday, this needs to be fixed.
- Remove unused getNewVnode.
- Remove unused coda_vget, coda_init, coda_quotactl prototypes.

MFC after:	1 month
2008-02-09 12:49:18 +00:00
Robert Watson
fc9d8f0057 No reason not to maintain stats on statfs in Coda, as it's done for
other VFS operations, so uncomment the existing statistics gathering.

MFC after:	1 month
2008-02-09 11:40:49 +00:00
Robert Watson
8571e9a189 Remove unused devtomp(), which exploited UFS-specific knowledge to find
the mountpoint for a specific device.  This was implemented incorrectly,
a bad idea in a fundamental sense, and also never used, so presumably
a long-idle debugging function.

MFC after:	1 month
2008-02-09 11:12:18 +00:00
Robert Watson
82e4904ffb Since Coda is effectively a stacked file system, use VOP_EOPNOTSUPP
for vop_bmap; delete the existing stub that returned either EINVAL
or EOPNOTSUPP, and had unreachable calls to VOP_BMAP on the cache
vnode.

MFC after:	1 month
2008-02-09 09:33:19 +00:00
Robert Watson
37245e3742 Lock cache vnode when VOP_FSYNC() is called on a Coda vnode.
MFC after:	1 month
2008-02-09 00:12:22 +00:00
Robert Watson
6dc70a9dec Make all calls to vn_lock() in Coda, including recently added ones,
use LK_RETRY, since failure is undesirable (and not handled).

MFC after:	1 month
Pointed out by:	kib
2008-02-09 00:03:22 +00:00
Robert Watson
7a246a6314 The Coda module was originally ported to NetBSD from Mach by rvb, and
then later to FreeBSD.  Update various NetBSD-related comments: in some
cases delete them because they don't appply, in others update to say
FreeBSD as they still apply but in FreeBSD (and might for that matter
no longer apply on NetBSD), and flag one case where I'm not sure
whether it applies.

MFC after:	1 month
2008-02-08 23:15:36 +00:00
Robert Watson
efeac2fb25 Before invoking vnode operations on cache vnodes, acquire the vnode
locks of those vnodes.  Probably, Coda should do the same lock sharing/
pass-through that is done for nullfs, but in the mean time this ensures
that locks are adequately held to prevent corruption of data structures
in the cache file system.

Assuming most operations came from the top layer of Coda and weren't
performed directly on the cache vnodes, in practice this corruption was
relatively unlikely as the Coda vnode locks were ensuring exclusive
access for most consumers.

This causes WITNESS to squeal like a pig immediately when Coda is used,
rather than waiting until file close; I noticed these problems because
of the lack of said squealing.

MFC after:	1 month
2008-02-08 23:01:40 +00:00
Robert Watson
99a2317ed3 Remove undefined coda excluded by #if 1 #else, which previously protected
vget() calls using inode numbers to query the root of /coda, which is not
needed since we now cache the root vnode with the mountpoint.

MFC after:	1 month
2008-02-08 22:37:15 +00:00
Robert Watson
9d3e5c0e2b Put "coda_rdwr: Internally Opening" printf generated by in-kernel writes
to files, such as ktrace output, under CODA_VERBOSE.  Otherwise, each
such call to VOP_WRITE() results in a kernel printf.

MFC after:	3 days
Obtained from:	NetBSD
2008-01-21 21:39:08 +00:00
Robert Watson
e866951b59 Replace references to VOP_LOCK() w/o LK_RETRY to vn_lock() with LK_RETRY,
avoiding extra error handling, or in some cases, missing error handling.

MFC after:	3 days
Discussed with:	kib
2008-01-21 21:19:07 +00:00
Robert Watson
9440b9f7ea Remove unused oldhash definition from Coda namecache.
MFC after:	3 days
2008-01-19 19:21:07 +00:00
Robert Watson
de5910460a Improve default vnode operation handling for Coda:
- Don't specify vnode operations for mknod, lease, and advlock--let them
  fall through to vop_default.

- Implement vop_default with &default_vnodeops, rather than with VOP_PANIC,
  so that unimplemented vnode operations are handled in more sensible ways
  than panicking, such as EOPNOTSUPP on ACL queries generated by bsdtar,
  or mknod.

MFC after:	3 days
2008-01-19 17:12:44 +00:00
Robert Watson
aeab4f72a0 Rework coda_statfs(): no longer need to zero the statfs structure or
fill out all fields, just fill out the ones the file system knows
about.  Among other things, this causes the outpuf of "mount" and
"df" to make quite a bit more sense as /dev/cfs0 is specified as the
mountfrom name.

MFC after:	3 days
2008-01-19 16:39:14 +00:00
Robert Watson
82bf4517ef Zero mi_rotovp and coda_ctlvp immediately after calling vrele() on the
vnodes during coda_unmount() in order to detect errant use of them
after the vnode references may no longer be valid.

No need to clear the VV_ROOT flag on mi_rootvp flag (especially after
the vnode reference is no longer valid) as this isn't done on other
file systems.

MFC after:	3 days
2008-01-19 15:40:46 +00:00
Robert Watson
96b1e9b015 Don't acquire an additional vnode reference to a vnode when it is opened
and then release it when it is closed: we rely on the caller to keep the
vnode around with a valid reference.  This avoids vrele() destroying the
vnode vop_close() is being called from during a call to vop_close(), and
a crash due to lockmgr recursing the vnode lock when a Coda unmount
occurs.

MFC after:	3 days
2008-01-19 15:39:10 +00:00
Robert Watson
76898521e8 Don't declare functions as extern.
Move all extern variable definitions to associated .h files, move some
extern variable definitions between include files to place them more
appropriately.

MFC after:	3 days
2008-01-19 14:32:44 +00:00
Robert Watson
11cc4ab95a Use VOP_NULL rather than VOP_PANIC for Coda's vop_print routine, so as
to avoid panicking in DDB show lockedvnods.

MFC after:	3 days
2008-01-19 13:41:56 +00:00
Robert Watson
d883e8e720 Lock the new directory vnode returned by coda_mkdir(), as this is required
by FreeBSD's vnode locking protocol.

MFC after:	3 days
2008-01-19 13:29:14 +00:00
Robert Watson
6885d70dfe Borrow the VM object associated with an underlying cache vnode with the
Coda vnode derived from it, in the style of nullfs.  This allows files
in the Coda file system to be memory-mapped, such as with execve(2) or
mmap(2).

MFC after:	3 days
Reported by:	Rune <u+openafsdev-sr55 at chalmers dot se>
2008-01-19 13:27:14 +00:00