svn commit: r321579 - stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs

[Alexander Motin]

Author: mav
Date: Wed Jul 26 19:01:15 2017
New Revision: 321579
URL: https://svnweb.freebsd.org/changeset/base/321579

Log:
  MFC r319953: MFV r319951: 8311 ZFS_READONLY is a little too strict
  
  illumos/illumos-gate at 2889ec41c05e9ffe1890b529b3111354da325aeb
  https://github.com/illumos/illumos-gate/commit/2889ec41c05e9ffe1890b529b3111354d
  a325aeb
  
  https://www.illumos.org/issues/8311
    Description:
    There was a misunderstanding about the enforcement details of the "Read-only"
    flag introduced for SMB/CIFS compatibility, way back in 2007 in the Sun PSARC
    2007/315 case.
    The original authors thought enforcement of the READONLY flag should work
    similarly as the IMMUTABLE flag. Unfortunately, that enforcement is
    incompatible with the expectations of Windows applications using this feature
    through the SMB service. Applications assume (and the MS File System Algorithm
  s
    MS-FSA confirms they should) that an SMB client can:
    (a) Open an SMB handle on a file with read/write access,
    (b) Set the DOS attributes to include the READONLY flag,
    (c) continue to have write access via that handle.
    This access model is essentially the same as a Unix/POSIX application that
    creates a file (with read/write access), uses fchmod() to change the file mode
    to something not granting write access (i.e. 0444), and then continues to writ
  e
    that file using the open handle it got before the mode change.
    Currently, the SMB server works-around this problem in a way that will become
    difficult to maintain as we implement support for SMB3 persistent handles, so
    SMB depends on this fix.
    I've written a test program that can be used to demonstrate this problem, and
    added it to zfs-tests (tests/functional/acl/cifs/cifs_attr_004_pos).
    It currently fails, but will pass when this problem fixed.
    Steps to Reproduce:
      Run the test program on a ZFS file system.
    Expected Results:
      Pass
    Actual Results:
      Fail.
  
  Reviewed by: Sanjay Nadkarni <sanjay.nadkarni at nexenta.com>
  Reviewed by: Yuri Pankov <yuri.pankov at nexenta.com>
  Reviewed by: Andrew Stormont <andyjstormont at gmail.com>
  Reviewed by: Matt Ahrens <mahrens at delphix.com>
  Reviewed by: John Kennedy <john.kennedy at delphix.com>
  Approved by: Prakash Surya <prakash.surya at delphix.com>
  Author: Gordon Ross <gwr at nexenta.com>

Modified:
  stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_acl.c
  stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c
Directory Properties:
  stable/11/   (props changed)

Modified: stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_acl.c
==============================================================================
--- stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_acl.c	Wed Jul 26 17:48:37 2017	(r321578)
+++ stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_acl.c	Wed Jul 26 19:01:15 2017	(r321579)
@@ -20,8 +20,8 @@
  */
 /*
  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
- * Copyright 2011 Nexenta Systems, Inc.  All rights reserved.
  * Copyright (c) 2013 by Delphix. All rights reserved.
+ * Copyright 2017 Nexenta Systems, Inc.  All rights reserved.
  */
 
 #include <sys/types.h>
@@ -2017,13 +2017,11 @@ zfs_zaccess_dataset_check(znode_t *zp, uint32_t v4_mod
 	}
 
 	/*
-	 * Only check for READONLY on non-directories.
+	 * Intentionally allow ZFS_READONLY through here.
+	 * See zfs_zaccess_common().
 	 */
 	if ((v4_mode & WRITE_MASK_DATA) &&
-	    (((ZTOV(zp)->v_type != VDIR) &&
-	    (zp->z_pflags & (ZFS_READONLY | ZFS_IMMUTABLE))) ||
-	    (ZTOV(zp)->v_type == VDIR &&
-	    (zp->z_pflags & ZFS_IMMUTABLE)))) {
+	    (zp->z_pflags & ZFS_IMMUTABLE)) {
 		return (SET_ERROR(EPERM));
 	}
 
@@ -2246,6 +2244,24 @@ zfs_zaccess_common(znode_t *zp, uint32_t v4_mode, uint
 	if (skipaclchk) {
 		*working_mode = 0;
 		return (0);
+	}
+
+	/*
+	 * Note: ZFS_READONLY represents the "DOS R/O" attribute.
+	 * When that flag is set, we should behave as if write access
+	 * were not granted by anything in the ACL.  In particular:
+	 * We _must_ allow writes after opening the file r/w, then
+	 * setting the DOS R/O attribute, and writing some more.
+	 * (Similar to how you can write after fchmod(fd, 0444).)
+	 *
+	 * Therefore ZFS_READONLY is ignored in the dataset check
+	 * above, and checked here as if part of the ACL check.
+	 * Also note: DOS R/O is ignored for directories.
+	 */
+	if ((v4_mode & WRITE_MASK_DATA) &&
+	    (ZTOV(zp)->v_type != VDIR) &&
+	    (zp->z_pflags & ZFS_READONLY)) {
+		return (SET_ERROR(EPERM));
 	}
 
 	return (zfs_zaccess_aces_check(zp, working_mode, B_FALSE, cr));

Modified: stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c
==============================================================================
--- stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c	Wed Jul 26 17:48:37 2017	(r321578)
+++ stable/11/sys/cddl/contrib/opensolaris/uts/common/fs/zfs/zfs_vnops.c	Wed Jul 26 19:01:15 2017	(r321579)
@@ -904,9 +904,11 @@ zfs_write(vnode_t *vp, uio_t *uio, int ioflag, cred_t 
 	}
 
 	/*
-	 * If immutable or not appending then return EPERM
+	 * If immutable or not appending then return EPERM.
+	 * Intentionally allow ZFS_READONLY through here.
+	 * See zfs_zaccess_common()
 	 */
-	if ((zp->z_pflags & (ZFS_IMMUTABLE | ZFS_READONLY)) ||
+	if ((zp->z_pflags & ZFS_IMMUTABLE) ||
 	    ((zp->z_pflags & ZFS_APPENDONLY) && !(ioflag & FAPPEND) &&
 	    (uio->uio_loffset < zp->z_size))) {
 		ZFS_EXIT(zfsvfs);
@@ -2945,10 +2947,9 @@ zfs_setattr(vnode_t *vp, vattr_t *vap, int flags, cred
 		return (SET_ERROR(EPERM));
 	}
 
-	if ((mask & AT_SIZE) && (zp->z_pflags & ZFS_READONLY)) {
-		ZFS_EXIT(zfsvfs);
-		return (SET_ERROR(EPERM));
-	}
+	/*
+	 * Note: ZFS_READONLY is handled in zfs_zaccess_common.
+	 */
 
 	/*
 	 * Verify timestamps doesn't overflow 32 bits.